Method and Apparatus for Handover of a Packet Switched Communication Session

ABSTRACT

Some embodiments provide a method of registering a user equipment (UE) in a communication system that includes a licensed wireless communication system and a generic access network (GAN) that has a generic access network controller (GANC). The method sends a register message from the UE to the GANC that indicates a GAN mode capability of A/Gb only for the UE. When the GANC has a GAN mode capability of A/Gb, the GANC registers the UE with the GAN. When the GANC has a GAN mode capability of Iu only, the GANC rejects the register request message. When the GANC has a GAN mode capability of both A/Gb and Iu, the GANC registers the UE based on a set of GANC mode selection rules that the GANC applies for registering UEs with the GAN.

CLAIM OF BENEFIT TO RELATED APPLICATIONS

This application claims the benefit of U.S. Provisional Application60/807,470, entitled “E-UMA—Technology,” filed Jul. 14, 2006; U.S.Provisional Application 60/823,092, entitled “Generic Access to the IuInterface,” filed Aug. 21, 2006; U.S. Provisional Application60/862,564, entitled “E-UMA—Generic Access to the Iu Interface,” filedOct. 23, 2006, and U.S. Provisional Application 60/949,826, entitled“Generic Access to the Iu Interface,” filed Jul. 13, 2007. The contentsof each of these four provisional applications are hereby incorporatedby reference.

FIELD OF THE INVENTION

The field of invention relates generally to telecommunications. Moreparticularly, this invention relates to a mechanism for extendingUnlicensed Mobile Access (UMA) or Generic Access Network (GAN) tointer-work with a GSM core network using the Universal MobileTelecommunication System (UMTS) Iu interface.

BACKGROUND OF THE INVENTION

Licensed wireless systems provide mobile wireless communications toindividuals using wireless transceivers. Licensed wireless systems referto public cellular telephone systems and/or Personal CommunicationServices (PCS) telephone systems. Wireless transceivers include cellulartelephones, PCS telephones, wireless-enabled personal digitalassistants, wireless modems, and the like.

Licensed wireless systems utilize wireless signal frequencies that arelicensed from governments. Large fees are paid for access to thesefrequencies. Expensive base station (BS) equipment is used to supportcommunications on licensed frequencies. Base stations are typicallyinstalled approximately a mile apart from one another (e.g., cellulartowers in a cellular network). The wireless transport mechanisms andfrequencies employed by typical licensed wireless systems limit bothdata transfer rates and range. As a result, the quality of service(voice quality and speed of data transfer) in licensed wireless systemsis considerably inferior to the quality of service afforded by landline(wired) connections. Thus, the user of a licensed wireless system paysrelatively high fees for relatively low quality service.

Landline (wired) connections are extensively deployed and generallyperform at a lower cost with higher quality voice and higher speed dataservices. The problem with landline connections is that they constrainthe mobility of a user. Traditionally, a physical connection to thelandline was required.

In the past few years, the use of unlicensed wireless communicationsystems to facilitate mobile access to landline-based networks has seenrapid growth. For example, such unlicensed wireless systems may supportwireless communication based on the IEEE 802.11a, b or g standards(WiFi), or the Bluetooth® standard. The mobility range associated withsuch systems is typically on the order of 100 meters or less. A typicalunlicensed wireless communication system includes a base stationcomprising a wireless access point (AP) with a physical connection(e.g., coaxial, twisted pair, or optical cable) to a landline-basednetwork. The AP has a RF transceiver to facilitate communication with awireless handset that is operative within a modest distance of the AP,wherein the data transport rates supported by the WiFi and Bluetooth®standards are much higher than those supported by the aforementionedlicensed wireless systems. Thus, this option provides higher qualityservices at a lower cost, but the services only extend a modest distancefrom the base station.

Currently, technology is being developed to integrate the use oflicensed and unlicensed wireless systems in a seamless fashion, thusenabling a user to access, via a single handset, an unlicensed wirelesssystem when within the range of such a system, while accessing alicensed wireless system when out of range of the unlicensed wirelesssystem.

SUMMARY OF THE INVENTION

Some embodiments provide a method of registering a user equipment (UE)in a communication system that includes a licensed wirelesscommunication system and a generic access network (GAN) that has ageneric access network controller (GANC). The method sends a registerrequest message from the UE to the GANC that indicates a GAN modecapability of A/Gb only for the UE. When the GANC has a GAN modecapability of A/Gb, the GANC registers the UE with the GAN. When theGANC has a GAN mode capability of Iu only, the GANC rejects the registerrequest message. When the GANC has a GAN mode capability of both A/Gband Iu, the GANC registers the UE based on a set of GANC mode selectionrules that the GANC applies for registering UEs with the GAN.

Some embodiments provide a method of activating a packet transportchannel (PTC) in a communication system that includes a first licensedwireless communication system and a second generic access network (GAN)that has a generic access network controller (GANC). The GANC iscommunicatively coupled to the first communication system through auniversal mobile telecommunication system (UMTS) terrestrial radioaccess network (UTRAN) Iu interface. The method sends a GA-PSR activatePTC request message from the GANC to a user equipment (UE). The messagecomprises a terminal endpoint identifier (TEID) that the GANC assigns tothe UE.

Some embodiments provide a communication system that includes a firstlicensed wireless communication system, a second generic access network(GAN) that includes a generic access network controller (GANC). The GANCis communicatively coupled to the first communication system through auniversal mobile telecommunication system (UMTS) terrestrial radioaccess network (UTRAN) Iu interface. The communication system alsoincludes a user equipment (UE). The GANC includes a UDP protocol layerand a GTP-U protocol layer over the UDP protocol layer of the GANC. TheUE includes a UDP protocol layer and a GTP-U protocol layer over saidUDP protocol layer of the UE. The UDP protocol layer of the GANC iscommunicatively coupled to the UDP protocol layer of the UE. The GTP-Uprotocol layer of the GANC is communicatively coupled to the GTP-Uprotocol layer of the UE.

BRIEF DESCRIPTION OF THE DRAWINGS

The novel features of the invention are set forth in the appendedclaims. However, for purpose of explanation, several embodiments of theinvention are set forth in the following figures.

FIG. 1 illustrates an integrated communication system (ICS) of someembodiments.

FIG. 2 illustrates several applications of an ICS in some embodiments.

FIG. 3 illustrates the overall A/Gb-mode GAN functional architecture ofsome embodiments.

FIG. 4 illustrates the overall Iu-mode GAN functional architecture ofsome embodiments.

FIG. 5 illustrates the basic elements of a Femtocell system architecturewith Asynchronous Transfer Mode based Iu interfaces towards the corenetwork in some embodiments.

FIG. 6 illustrates the basic elements of a Femtocell system architecturewith an IP based Iu interface towards the core network in someembodiments.

FIG. 7 illustrates the CS domain control plane architecture of someembodiments.

FIG. 8 illustrates the CS domain control plane architecture of someembodiments.

FIG. 9 illustrates the CS domain control plane architecture of someembodiments.

FIG. 10 illustrates the UE CS domain control plane architecture of someembodiments.

FIG. 11 illustrates CS domain user plane protocol architecture of someembodiments.

FIG. 12 illustrates CS domain user plane protocol architecture of someembodiments.

FIG. 13 illustrates the UE CS domain user plane architecture of someembodiments.

FIG. 14 illustrates PS domain control plane architecture of someembodiments.

FIG. 15 illustrates PS domain control plane architecture of someembodiments.

FIG. 16 illustrates the UE PS domain control architecture of someembodiments.

FIG. 17 illustrates PS domain user plane protocol architecture of someembodiments.

FIG. 18 illustrates PS domain user plane protocol architecture of someembodiments.

FIG. 19 illustrates PS domain user plane protocol architecture of someembodiments.

FIG. 20 illustrates the UE PS domain user plane architecture of someembodiments.

FIG. 21 illustrates state diagram for generic access in the UE of someembodiments.

FIG. 22 illustrates GAN security mechanisms of some embodiments.

FIG. 23 illustrates discovery procedure of some embodiments.

FIG. 24 illustrates registration procedure of some embodiments.

FIG. 25 illustrates De-Registration initiated by the UE in someembodiments.

FIG. 26 illustrates De-Registration initiated by the GANC in someembodiments.

FIG. 27 illustrates registration Update Uplink of some embodiments.

FIG. 28 illustrates Registration Update Downlink of some embodiments.

FIG. 29 illustrates Keep Alive procedure of some embodiments.

FIG. 30 illustrates Cell Broadcast Information in some embodiments.

FIG. 31 illustrates GA-CSR Connection Establishment of some embodiments.

FIG. 32 illustrates GA-CSR Connection Release in some embodiments.

FIG. 33 illustrates Security Mode Control in some embodiments.

FIG. 34 illustrates core network to UE NAS signaling in someembodiments.

FIG. 35 illustrates UE to core network NAS signaling in someembodiments.

FIG. 36 illustrates Mobile Originated CS Call in some embodiments.

FIG. 37 illustrates Mobile Originated CS Call in some embodiments.

FIG. 38 illustrates Mobile Terminated CS Call in some embodiments.

FIG. 39 illustrates UE initiated CS Call clearing in some embodiments.

FIG. 40 illustrates CS Handover from GERAN to GAN in some embodiments.

FIG. 41 illustrates an alternative procedure performed during GERAN toGAN in some embodiments.

FIG. 42 illustrates CS Handover from UTRAN to GAN in some embodiments.

FIG. 43 illustrates an alternative procedure performed during UTRAN toGAN in these embodiments.

FIG. 44 illustrates CS Handover from GAN to GERAN in some embodiments.

FIG. 45 illustrates CS Handover from GAN to UTRAN in some embodiments.

FIG. 46 illustrates GA-PSR Connection Establishment of some embodiments.

FIG. 47 illustrates GA-PSR Connection Release in some embodiments.

FIG. 48 illustrates the message flow for PS security mode control insome embodiments.

FIG. 49 illustrates core network to user equipment PS NAS signaling insome embodiments.

FIG. 50 illustrates user equipment to core network NAS signaling in someembodiments.

FIG. 51 illustrates PTC initial activation in some embodiments.

FIG. 52 illustrates PTC Data Transfer in some embodiments.

FIG. 53 illustrates UE initiated PTC deactivation in some embodiments.

FIG. 54 illustrates UE initiated PTC re-activation in some embodiments.

FIG. 55 illustrates Network initiated PTC de-activation in someembodiments.

FIG. 56 illustrates Network initiated PTC re-activation in someembodiments.

FIG. 57 illustrates Implicit PTC deactivation in some embodiments.

FIG. 58 illustrates PDP Context Activation in some embodiments.

FIG. 59 illustrates Network Requested PDP Context Activation in someembodiments.

FIG. 60 illustrates UTRAN to GAN SRNS Relocation Preparation Phase insome embodiments.

FIG. 61 illustrates UTRAN to GAN SRNS Relocation Execution Phase in someembodiments.

FIG. 62 illustrates GAN to UTRAN SRNS Relocation Preparation Phase insome embodiments.

FIG. 63 illustrates GAN to UTRAN SRNS Relocation Execution Phase in someembodiments.

FIG. 64 illustrates the GAN architecture in support of the CS Domaincontrol plane in some embodiments.

FIG. 65 illustrates the GAN protocol architecture in support of the CSdomain user plane in some embodiments.

FIG. 66 illustrates the GAN architecture in support of the PS DomainControl Plane in some embodiments.

FIG. 67 illustrates the GAN architecture for the PS Domain User Plane insome embodiments.

FIG. 68 illustrates the GA-RC sublayer in the UE in some embodiments.

FIG. 69 illustrates successful (and unsuccessful) establishment of theGA-RRC Connection when initiated by the UE in some embodiments.

FIG. 70 illustrates successful establishment of the GA-RRC Connectionwhen initiated by the network in some embodiments.

FIG. 71 shows release of the logical GA-RRC connection between the UEand the GANC in some embodiments.

FIG. 72 illustrates the message flow for security mode control in someembodiments.

FIG. 73 illustrates core network to UE NAS signaling of someembodiments.

FIG. 74 illustrates the UE to core network NAS signaling of someembodiments.

FIG. 75 illustrates mobile originated CS call procedure in someembodiments.

FIG. 76 illustrates an alternative procedure performed during a mobileoriginated CS call in some embodiments.

FIG. 77 illustrates mobile terminated CS call procedure in someembodiments.

FIG. 78 illustrates call clearing initiated by the UE in someembodiments.

FIG. 79 illustrates the CS Handover from GERAN to GAN procedure in someembodiments.

FIG. 80 illustrates an alternative procedure for CS handover from GERANto GAN in some embodiments.

FIG. 81 illustrates the CS Handover from UTRAN to GAN procedure in someembodiments.

FIG. 82 illustrates an alternative procedure for CS handover from UTRANto GAN using RRC protocol in some embodiments.

FIG. 83 illustrates the CS handover from GAN to GERAN procedure in someembodiments.

FIG. 84 illustrates the CS handover from GAN to UTRAN procedure in someembodiments.

FIG. 85 illustrates the Packet Transport Channel initial activationprocedure of some embodiments.

FIG. 86 illustrates the transfer of GPRS user data packets via the GANPacket Transport Channel in some embodiments.

FIG. 87 illustrates the scenario when the user equipment deactivates thePacket Transport Channel after the PTC Timer expires in someembodiments.

FIG. 88 illustrates the scenario when the user equipment initiatesre-activation of the Packet Transport Channel in some embodiments.

FIG. 89 illustrates the scenario when the network initiatesde-activation of the Packet Transport Channel in some embodiments.

FIG. 90 illustrates the scenario when the network initiatesre-activation of the Packet Transport Channel in some embodiments.

FIG. 91 illustrates the successful user equipment initiated PDP ContextActivation procedure in some embodiments.

FIG. 92 illustrates the successful Network-Requested PDP ContextActivation procedure in some embodiments.

FIG. 93 illustrates the successful UE-initiated PDP Context Activationprocedure in some embodiments.

FIG. 94 illustrates SRNS relocation procedure from UTRAN to GAN for a UEthat is in PMM Connected state in some embodiments.

FIG. 95 conceptually illustrates a computer system with which someembodiments of the invention are implemented.

FIG. 96 illustrates the procedure for implicit PTC de-activation in someembodiments.

DETAILED DESCRIPTION OF THE INVENTION

In the following detailed description of the invention, numerousdetails, examples, and embodiments of the invention are set forth anddescribed. However, it will be clear and apparent to one skilled in theart that the invention is not limited to the embodiments set forth andthat the invention may be practiced without some of the specific detailsand examples discussed.

Throughout the following description, acronyms commonly used in thetelecommunications industry for wireless services are utilized alongwith acronyms specific to the present invention. A table of acronymsused in this application is included in Section IX.

Some embodiments provide a method of registering a user equipment (UE)in a communication system that includes a licensed wirelesscommunication system and a generic access network (GAN) that has ageneric access network controller (GANC). The method sends a registerrequest message from the UE to the GANC that indicates a GAN modecapability of A/Gb only for the UE. When the GANC has a GAN modecapability of A/Gb, the GANC registers the UE with the GAN. When theGANC has a GAN mode capability of Iu only, the GANC rejects the registerrequest message. When the GANC has a GAN mode capability of both A/Gband Iu, the GANC registers the UE based on a set of GANC mode selectionrules that the GANC applies for registering UEs with the GAN.

Some embodiments provide a method of activating a packet transportchannel (PTC) in a communication system that includes a first licensedwireless communication system and a second generic access network (GAN)that has a generic access network controller (GANC). The GANC iscommunicatively coupled to the first communication system through auniversal mobile telecommunication system (UMTS) terrestrial radioaccess network (UTRAN) Iu interface. The method sends a GA-PSR activatePTC request message from the GANC to a user equipment (UE). The messagecomprises a terminal endpoint identifier (TEID) that the GANC assigns tothe UE.

Some embodiments provide a communication system that includes a firstlicensed wireless communication system, a second generic access network(GAN) that includes a generic access network controller (GANC). The GANCis communicatively coupled to the first communication system through auniversal mobile telecommunication system (UMTS) terrestrial radioaccess network (UTRAN) Iu interface. The communication system alsoincludes a user equipment (UE). The GANC includes a UDP protocol layerand a GTP-U protocol layer over the UDP protocol layer of the GANC. TheUE includes a UDP protocol layer and a GTP-U protocol layer over saidUDP protocol layer of the UE. The UDP protocol layer of the GANC iscommunicatively coupled to the UDP protocol layer of the UE. The GTP-Uprotocol layer of the GANC is communicatively coupled to the GTP-Uprotocol layer of the UE.

Several more detailed embodiments of the invention are described insections below. Specifically, Section I describes the overall integratedcommunication system in which some embodiments are incorporated. Thediscussion in Section I is followed by a discussion of the functionalentities of some embodiments in Section II. Next, Section III describesthe control and user plane architecture of some embodiments. Section IVthen describes the generic access network (GAN) security mechanism ofsome embodiments.

Next, Section V describes high level procedures such as discovery,registration, authentication, handover, etc. of some embodiments.Section VI then describes the configuration information of someembodiments. Next, identifiers used in GAN are presented in Section VII.An alternative embodiment that utilizes the same protocol for both voiceand data services is disclosed in Section VIII. The discussion isfollowed by Section IX description of a computer system with which someembodiments of the invention are implemented. Finally, Section X liststhe abbreviations used.

I. OVERALL SYSTEM

A. Integrated Communication Systems (ICS)

FIG. 1 illustrates an integrated communication system (ICS) architecture100 in accordance with some embodiments of the present invention. ICSarchitecture 100 enables user equipment (UE) 102 to access a voice anddata network 165 via either a licensed air interface 106 or an ICSinterface 110 through which components of a mobile core network 165 arealternatively accessed. In some embodiments, a communication sessionincludes voice services, data services, or both.

The mobile core network 165 includes one or more Home Location Registers(HLRs) 150 and databases 145 for subscriber authentication andauthorization. Once authorized, the UE 102 may access the voice and dataservices of the mobile core network 165. In order to provide suchservices, the mobile core network 165 includes a mobile switching center(MSC) 160 for providing access to the voice services. Data services areprovided for through a Serving GPRS (General Packet Radio Service)Support Node (SGSN) 155 in conjunction with a gateway such as theGateway GPRS Support Node (GGSN) 157.

The SGSN 155 is typically responsible for delivering data packets fromand to the GGSN 157 and the user equipment within the geographicalservice area of the SGSN 155. Additionally, the SGSN 155 may performfunctionality such as mobility management, storing user profiles, andstoring location information. However, the actual interface from themobile core network 165 to various external data packet servicesnetworks (e.g., public Internet) is facilitated by the GGSN 157. As thedata packets originating from the user equipment typically are notstructured in the format with which to access the external datanetworks, it is the role of the GGSN 157 to act as the gateway into suchpacket services networks. In this manner, the GGSN 157 providesaddressing for data packets passing to and from the UE 102 and theexternal packet services networks (not shown). Moreover, as the userequipment of a licensed wireless network traverses multiple serviceregions and thus multiple SGSNs, it is the role of the GGSN 157 toprovide a static gateway into the external data networks.

In the illustrated embodiment, components common to a UMTS TerrestrialRadio Access Network (UTRAN) based cellular network 185 are depictedthat include multiple base stations referred to as Node Bs 180 (of whichonly one is shown for simplicity) that facilitate wireless communicationservices for various user equipment 102 via respective licensed radiolinks 106 (e.g., radio links employing radio frequencies within alicensed bandwidth). However, one of ordinary skill in the art willrecognize that in some embodiments, the licensed wireless network mayinclude other licensed wireless networks such as the GSM/EDGE RadioAccess Network (GERAN). An example of a system using A and Gb interfacesto access GERAN is shown in FIG. 3 below.

The licensed wireless channel 106 may comprise any licensed wirelessservice having a defined UTRAN or GERAN interface protocol (e.g., Iu-csand Iu-ps interfaces for UTRAN or A and Gb interfaces for GERAN) for avoice/data network. The UTRAN 185 typically includes at least one Node B180 and a Radio Network Controller (RNC) 175 for managing the set ofNode Bs 180. Typically, the multiple Node Bs 180 are configured in acellular configuration (one per each cell) that covers a wide servicearea.

Each RNC 175 communicates with components of the core network 165through a standard radio network controller interface such as the Iu-csand Iu-ps interfaces depicted in FIG. 1. For example, a RNC 175communicates with MSC 160 via the UTRAN Iu-cs interface for circuitswitched voice services. Additionally, the RNC 175 communicates withSGSN 155 via the UTRAN Iu-ps interface for packet data services throughGGSN 157. Moreover, one of ordinary skill in the art will recognize thatin some embodiments, other networks with other standard interfaces mayapply. For example, the RNC 175 in a GERAN network is replaced with aBase Station Controller (BSC) that communicates voice to the MSC 160 viaan A interface and the BSC communicates data to the SGSN via a Gbinterface of the GERAN network.

In some embodiments of the ICS architecture, the user equipment 102 usethe services of the mobile core network (CN) 165 via a secondcommunication network facilitated by the ICS access interface 110 and aGeneric Access Network Controller (GANC) 120 (also referred to as aUniversal Network Controller or UNC).

In some embodiments, the voice and data services over the ICS accessinterface 110 are facilitated via an access point 114 communicativelycoupled to a broadband IP network 116. In some embodiments, the accesspoint 114 is a generic wireless access point that connects the userequipment 102 to the ICS network through an unlicensed wireless network118 created by the access point 114.

The signaling from the UE 102 is passed over the ICS access interface110 to the GANC 120. After the GANC 120 performs authentication andauthorization of the subscriber, the GANC 120 communicates withcomponents of the mobile core network 165 using a radio networkcontroller interface that is the same or similar to the radio networkcontroller interface of the UTRAN described above, and includes a UTRANIu-cs interface for circuit switched voice services and a UTRAN Iu-psinterface for packet data services (e.g., GPRS). In this manner, theGANC 120 uses the same or similar interface to the mobile core networkas a UTRAN Radio Network Subsystem (e.g., the Node B 180 and RNC 175).

In some embodiments, the GANC 120 communicates with other systemcomponents of the ICS system through one or more of several otherinterfaces, which are (1) “Up”, (2) “Wm”, (3) “D′/Gr′”, (4) “Gn′”, and(5) “S1”. The “Up” interface is the interface between the UE 102 and theGANC 120. The “Wm” interface is a standardized interface between theGANC 120 and an Authorization, Authentication, and Accounting (AAA)Server 170 for authentication and authorization of the UE 102 into theICS. The “D′/Gr′” interface is the standard interface between the AAAserver 170 and the HLR 160. Optionally, some embodiments use the “Gn′”interface which is a modified interface for direct communications withthe data services gateway (e.g., GGSN) of the core licensed network.Some embodiments optionally include the “S1” interface. In theseembodiments, the “S1” interface provides an authorization andauthentication interface from the GANC 120 to an AAA 140 server. In someembodiments, the AAA server 140 that supports the S1 interface and theAAA server 170 that supports Wm interface may be the same. More detailsof the S1 interface are described in U.S. application Ser. No.11/349,025, entitled “Service Access Control Interface for an UnlicensedWireless Communication System”, filed Feb. 6, 2006.

In some embodiments, the UE 102 must register with the GANC 120 prior toaccessing ICS services. Registration information of some embodimentsincludes a subscriber's International Mobile Subscriber Identity (IMSI),a Media Access Control (MAC) address, and a Service Set Identifier(SSID) of the serving access point as well as the cell identity from theGSM or UTRAN cell upon which the UE 102 is already camped. In someembodiments, the GANC 120 may pass this information to the AAA server140 to authenticate the subscriber and determine the services (e.g.,voice and data) available to the subscriber. If approved by the AAA 140for access, the GANC 120 will permit the UE 102 to access voice and dataservices of the ICS system.

These voice and data services are seamlessly provided by the ICS to theUE 102 through the various interfaces described above. In someembodiments, when data services are requested by the UE 102, the ICSuses the optional Gn′ interface for directly communicating with a GGSN157. The Gn′ interface allows the GANC 120 to avoid the overhead andlatency associated with communicating with the SGSN 155 over the Iu-psinterface of the UTRAN or the Gb interface of the GSM core networksprior to reaching the GGSN 157.

In some other embodiments, the access point 114 is a Femtocell accesspoint (FAP). The FAP facilitates short-range licensed wirelesscommunication sessions 118 that operate independent of the licensedcommunication session 106. In case of the Femtocell, the user equipment102 connects to the ICS network through the short-range licensedwireless network 118 created by the FAP 114. Signals from the FAP arethen transmitted over the broadband IP network 116.

B. Applications of ICS

An ICS provides scalable and secure interfaces into the core servicenetwork of mobile communication systems. FIG. 2 illustrates severalapplications of an ICS in some embodiments. As shown, homes, offices,hot spots, hotels, and other public and private places 205 are connectedto one or more network controllers 210 (such as the GANC 120 shown inFIG. 1) through the Internet 215. The network controllers in turnconnect to the mobile core network 220 (such as the core network 165shown in FIG. 1).

FIG. 2 also shows several user equipments. These user equipments arejust examples of user equipments that can be used for each application.Although in most examples only one of each type of user equipments isshown, one of ordinary skill in the art would realize that other type ofuser equipments can be used in these examples without deviating from theteachings of the invention. Also, although only of each type of accesspoints, user equipment, or network controllers are shown, many suchaccess points, user equipments, or network controllers may be employedin FIG. 2. For instance, an access point may be connected to severaluser equipment, a network controller may be connected to several accesspoints, and several network controllers may be connected to the corenetwork. The following sub-sections provide several examples of servicesthat can be provided by an ICS.

1. Wi-Fi

A Wi-Fi access point 230 enables a dual-mode cellular/Wi-Fi UEs 260-265to receive high-performance, low-cost mobile services when in range of ahome, office, or public Wi-Fi network. With dual-mode UEs, subscriberscan roam and handover between licensed wireless communication system andWi-Fi access and receive a consistent set of services as they transitionbetween networks.

2. Femtocells

A Femtocell enables user equipments, such as standard mobile stations270 and wireless enabled computers 275 shown, to receive low costservices using a short-range licensed wireless communication sessionsthrough a FAP 235.

3. Terminal Adaptors

Terminal adaptors 240 allow incorporating fixed-terminal devices such astelephones 245, Faxes 250, and other equipments that are not wirelessenabled within the ICS. As long as the subscriber is concerned, theservice behaves as a standard analog fixed telephone line. The serviceis delivered in a manner similar to other fixed line VoIP services,where a UE is connected to the subscriber's existing broadband (e.g.,Internet) service.

4. WiMAX

Some licensed wireless communication system operators are investigatingdeployment of WiMAX networks in parallel with their existing cellularnetworks. A dual mode cellular/WiMAX UE 290 enables a subscriber toseamlessly transition between a cellular network and such a WiMAXnetwork.

5. SoftMobiles

Connecting laptops 280 to broadband access at hotels and Wi-Fi hot spotshas become popular, particularly for international business travelers.In addition, many travelers are beginning to utilize their laptops andbroadband connections for the purpose of voice communications. Ratherthan using mobile phones to make calls and pay significant roaming fees,they utilize SoftMobiles (or SoftPhones) and VoIP services when makinglong distance calls.

To use a SoftMobile service, a subscriber would place a USB memory stick285 with an embedded SIM into a USB port of their laptop 280. ASoftMobile client would automatically launch and connect over IP to themobile service provider. From that point on, the subscriber would beable to make and receive mobile calls as if she was in her home callingarea.

Several examples of Integrated Communication Systems (ICS) are given inthe following sub-sections. A person of ordinary skill in the art wouldrealize that the teachings in these examples can be readily combined.For instance, an ICS can be an IP based system and have an A/Gbinterface towards the core network while another ICS can have a similarIP based system with an Iu interface towards the core network.

C. Integrated Systems with A/Gb and/or Iu Interfaces Towards the CoreNetwork

FIG. 3 illustrates the A/Gb-mode Generic Access Network (GAN) functionalarchitecture of some embodiments. The GAN includes one or more GenericAccess Network Controllers (GANC) 310 and one or more generic IP accessnetworks 315. One or more UEs 305 (one is shown for simplicity) canconnect to a GANC 310 through a generic IP access network 315. The GANC310 has the capability to appear to the core network 325 as a GSM/EDGERadio Access Network (GERAN) Base Station Controller (BSC). The GANC 310includes a Security Gateway (SEGW) 320 that terminates secure remoteaccess tunnels from the UE 305, providing mutual authentication,encryption and data integrity for signaling, voice and data traffic.

The generic IP access network 315 provides connectivity between the UE305 and the GANC 310. The IP transport connection extends from the GANC310 to the UE 305. A single interface, the Up interface, is definedbetween the GANC 310 and the UE 305.

The GAN co-exists with the GERAN and maintains the interconnections withthe Core Network (CN) 325 via the standardized interfaces defined forGERAN. These standardized interfaces include the A interface to MobileSwitching Center (MSC) 330 for circuit switched services, Gb interfaceto Serving GPRS Support Node (SGSN) 335 for packet switched services, Lbinterface to Serving Mobile Location Center (SMLC) 350 for supportinglocation services, and an interface to Cell Broadcast Center (CBC) 355for supporting cell broadcast services. The transaction control (e.g.Connection Management, CC, and Session Management, SM) and user servicesare provided by the core network (e.g. MSC/VLR and the SGSN/GGSN).

As shown, the SEGW 320 is connected to a AAA server 340 over the Wminterface. The AAA server 340 is used to authenticate the UE 305 when itsets up a secure tunnel. Some embodiments require only a subset of theWm functionalities for the GAN application. In these embodiments, as aminimum the GANC-SEGW shall support the Wm authentication procedures.

FIG. 4 illustrates the Iu-mode Generic Access Network (GAN) functionalarchitecture of some embodiments. The GAN includes one or more GenericAccess Network Controllers (GANC) 410 and one or more generic IP accessnetworks 415. One or more UEs 405 (one is shown for simplicity) can beconnected to a GANC 410 through a generic IP access network 415. Incomparison with the GANC 310, the GANC 410 has the capability to appearto the core network 425 as a UMTS Terrestrial Radio Access Network(UTRAN) Radio Network Controller (RNC). In some embodiments, the GANChas the expanded capability of supporting both the Iu and A/Gbinterfaces to concurrently support both Iu-mode and A/Gb-mode UEs.Similar to the GANC 310, the GANC 410 includes a Security Gateway (SEGW)420 that terminates secure remote access tunnels from the UE 405,providing mutual authentication, encryption and data integrity forsignaling, voice and data traffic.

The generic IP access network 415 provides connectivity between the UE405 and the GANC 410. The IP transport connection extends from the GANC410 to the UE 405. A single interface, the Up interface, is definedbetween the GANC 410 and the UE 405. Functionality is added to thisinterface, over the UP interface shown in FIG. 3 to support the Iu-modeGAN service.

The GAN co-exists with the UTRAN and maintains the interconnections withthe Core Network (CN) 425 and via the standardized interfaces definedfor UTRAN. These standardized interfaces include the Iu-cs interface toMobile Switching Center (MSC) 430 for circuit switched services, Iu-psinterface to Serving GPRS Support Node (SGSN) 435 for packet switchedservices, Iu-pc interface to Serving Mobile Location Center (SMLC) 450for supporting location services, and Iu-bc interface to Cell BroadcastCenter (CBC) 455 for supporting cell broadcast services. The transactioncontrol (e.g. Connection Management, CC, and Session Management, SM) anduser services are provided by the core network (e.g. MSC/VLR and theSGSN/GGSN).

As shown, the SEGW 420 is connected to a AAA server 440 over the Wminterface. The AAA server 440 is used to authenticate the UE 405 when itsets up a secure tunnel. Some embodiments require only a subset of theWm functionalities for the Iu mode GAN application. In theseembodiments, as a minimum the GANC-SEGW shall support the Wmauthentication procedures.

D. ATM and IP Based Architectures

In some embodiments, the system uses Asynchronous Transfer Mode (ATM)based Iu (Iu-cs and Iu-ps) interfaces towards the CN. In someembodiments, the system architecture can also support an IP based Iu(Iu-cs and Iu-ps) interface towards the CN. The following twosub-sections describe examples of these architectures for Femtocell.

A person of ordinary skill in the art would realize that the sameexamples can be readily applied to other types of ICS. For instance,these examples can be used when the ICS access interface 110 (shown inFIG. 1) uses unlicensed frequencies (instead of Femtocell's licensedfrequencies), the access point 114 is a generic WiFi access point(instead of a FAP), etc. Also, a person of ordinary skill in the artwould realize that the same examples can be readily implemented usingA/Gb interfaces (described above) instead of Iu interfaces.

FIG. 5 illustrates the basic elements of a Femtocell system architecturewith Asynchronous Transfer Mode (ATM) based Iu (Iu-cs and Iu-ps)interfaces towards the CN in some embodiments. These elements includethe user equipment (UE) 505, the FAP 510, and the Generic Access NetworkController (GANC) 515, and the Access Point Management SYSTEM (AMS) 570.

For simplicity, only one UE and one FAP are shown. However, each GANCcan support multiple FAPs and each FAP in turn can support multiple UEs.As shown, the GANC 515 includes an IP Network Controller (INC) 525, aGANC Security Gateway (SeGW) 530, a GANC Signaling Gateway 535, a GANCMedia Gateway (MGW) 540, an ATM Gateway (545). Elements of the Femtocellare described further below.

FIG. 6 illustrates the basic elements of a Femtocell system architecturewith an IP based Iu (Iu-cs and Iu-ps) interface towards the CN in someembodiments. For simplicity, only one UE and one FAP are shown. However,each GANC can support multiple FAPs and each FAP in turn can supportmultiple UEs. This option eliminates the need for the GANC Signalinggateway 535 and also the ATM gateway 545. Optionally for IP based Iuinterface, the GANC Media Gateway 540 can also be eliminated if the R4MGW 605 in the CN can support termination of voice data i.e. RTP framesas defined in “IETF RFC 3267—Real-Time Transport Protocol (RTP) PayloadFormat and File Storage Format for the Adaptive Multi-Rate (AMR) andAdaptive Multi-Rate Wideband (AMR-WB) Audio Codecs”, “RFC 3267”.

Also shown in FIGS. 5 and 6 are components of the licensed wirelesscommunication systems. These components are 3G MSC 550, 3G SGSN 555, andother Core Network System (shown together) 565. The 3G MSC 550 providesa standard Iu-cs interface towards the GANC. Another alternative for theMSC is shown in FIG. 6. As shown, the MSC 650 is split up into a MSS(MSC Server) 675 for Iu-cs based signaling and MGW 680 for the bearerpath. R4 MSC 650 is a release 4 version of a 3G MSC with a differentarchitecture i.e. R4 MSC is split into MSS for control traffic and a MGWfor handling the bearer. A similar MSC can be used for the ATMarchitecture of FIG. 5. Both architectures shown in FIGS. 5 and 6 arealso adaptable to use any future versions of the MSC.

The 3G SGSN 555 provides packet services (PS) via the standard Iu-psinterface. The SGSN connects to the INC 525 for signaling and to theSeGW 530 for PS data. The AAA server 560 communicates with the SeGW 530and supports the EAP-AKA and EAP-SIM procedures used in IKEv2 over theWm interface and includes a MAP interface to the HLR/AuC. In someembodiments, this system also supports the enhanced service accesscontrol functions over the S1 interface.

II. FUNCTIONAL ENTITIES

A. User Equipment

The UE 405 contains the functions that are required to access theIu-mode GAN. In some embodiments, the UE additionally contains that arerequired to access the A/Gb-mode GAN. In some embodiments, the UserEquipment (UE) 305 is a dual mode (e.g., GSM and unlicensed radios)handset device with capability to switch between the two modes. The userequipment can support either Bluetooth® or IEEE 802.11 protocols. Insome embodiments, the UE supports an IP interface to the access point.In these embodiments, the IP connection from the GANC extends all theway to the UE. In some other embodiments, the User Equipment (UE) 305 isa standard 3G handset device operating over licensed spectrum of theprovider.

In some embodiments, the user equipment includes a cellular telephone,smart phone, personal digital assistant, or computer equipped with asubscriber identity mobile (SIM) card for communicating over thelicensed or unlicensed wireless networks. Moreover, in some embodimentsthe computer equipped with the SIM card communicates through a wiredcommunication network.

Alternatively, in some embodiments the user equipment includes a fixedwireless device providing a set of terminal adapter functions forconnecting Integrated Services Digital Network (ISDN), SessionInitiation Protocol (SIP), or Plain Old Telephone Service (POTS)terminals to the ICS. Application of the present invention to this typeof device enables the wireless service provider to offer the so-calledlandline replacement service to users, even for user locations notsufficiently covered by the licensed wireless network. Moreover, someembodiments of the terminal adapters are fixed wired devices forconnecting ISDN, SIP, or POTS terminals to a different communicationnetwork (e.g., IP network) though alternate embodiments of the terminaladapters provide wireless equivalent functionality for connectingthrough unlicensed or licensed wireless networks.

B. Generic Access Network Controller (GANC)

The core network 425 interacts with the GANC 410 as though it was anRNC. The generic IP access network 415 provides connectivity between theGANC 410 and the UE 405. The GANC 410 entity inter-works between the Iuinterfaces and a generic IP access network, using the control plane anduser plane functionalities. The control plane functionality is utilizedfor call control signaling and the user plane functionality is utilizedfor information transfer (e.g., voice or data). In some embodiments, theGANC has the extended capability to also inter-work with GERAN A/Gbinterfaces.

Some embodiments of the above mentioned devices, such as the userequipment, FAP, or GANC, include electronic components, such asmicroprocessors and memory (not shown), that store computer programinstructions for executing wireless protocols for managing voice anddata services in a machine-readable or computer-readable medium asfurther described below in the section labeled “Computer System”.Examples of machine-readable media or computer-readable media include,but are not limited to magnetic media such as hard disks, memorymodules, magnetic tape, optical media such as CD-ROMS and holographicdevices, magneto-optical media such as optical disks, and hardwaredevices that are specially configured to store and execute program code,such as application specific integrated circuits (ASICs), programmablelogic devices (PLDs), ROM, and RAM devices. Examples of computerprograms or computer code include machine code, such as produced by acompiler, and files containing higher-level code that are executed by acomputer, an electronic component, or a microprocessor using aninterpreter.

III. CONTROL AND USER PLANE ARCHITECTURE

In some embodiments, the Iu interface includes support for bothAsynchronous Transfer Mode (ATM) and IP-based signaling and user datatransport mechanisms. The following sections describe the control anduser plane architectures for the Circuit Switched (CS) domain and PacketSwitched (PS) domain of some embodiments.

A. Circuit Switched (CS) Domain

1. CS Domain—Control Plane

FIG. 7 illustrates the GAN architecture in support of the CS Domaincontrol plane in some embodiments. The figure shows different protocollayers for the UE 705, Generic IP Network 710, GANC 715, and MSC 720.FIG. 7 also shows the two interfaces Up 725 and Iu-cs 730. The mainfeatures of the GAN CS domain control plane architecture are as follows.The underlying Access Layers 735 and Transport IP layer 740 provide thegeneric IP connectivity between the UE 705 and the GANC 715. The IPSeclayer 745 provides encryption and data integrity between the UE 705 andGANC 715. The Remote IP layer 750 is the ‘inner’ IP layer for IPSectunnel mode and is used by the UE 705 to be addressed by the GANC 715.The Remote IP layer 750 is configured during the IPSec connectionestablishment.

In some embodiments, a single TCP connection is used to provide reliabletransport for both the GA-RC and GA-CSR signaling between the UE 705 andGANC 715. The TCP connection is managed by GA-RC and is transportedusing the Remote IP layer. Non-Access Stratum (NAS) protocols, such asMM 760 and above, are carried transparently between the UE 705 and MSC720. The Generic Access Resource Control (GA-RC) protocol manages the Upsession, including the GAN discovery and registration procedures. TheGA-RC protocol (described in clause 8.1.4 of “Generic access to the A/Gbinterface; Stage 2”, 3GPP TS 43.318 standard) is extended to includesupport for the selection of either A/Gb mode or Iu mode GAN.

The Generic Access Circuit Switched Resource (GA-CSR) protocol supportsUMTS-specific requirements as well as GERAN-specific requirements. TheGANC 715 terminates the GA-CSR protocol and inter-works it to the RANAP755 protocol over the Iu-cs 730 interface. In some embodiments, theIu-cs signaling transport layers 765 are per “UTRAN Iu interfacesignalling transport”, 3GPP TS 25.412 standard, hereinafter “3GPP TS25.412”.

a) Alternative Architectures for CS Domain—Control Plane

The embodiment shown in FIG. 7 is just one alternative for implementingthe CS domain control plane architecture in which a UE 705 and a GenericIP Network 710 are used to connect a subscriber using the UE to the MSC720 through the GANC 715. A person of ordinary skill in the art wouldrealize that the teachings of the invention can be applied for otheruser equipment and access points (such as the ones described in FIG. 2).

For instance, FIG. 8 illustrates the CS domain control planearchitecture of some embodiments. As shown, the GANC and MSC in FIG. 8are similar to the GANC and MSC shown in FIG. 7. In FIG. 8, the localnode in which the subscriber is located is represented as a black box(referred to as Local Node 805). Different embodiments utilize differentequipments in order to connect a subscriber located in the Local Node805 with the MSC 720 through the GANC 715. For instance, in theembodiment shown in FIG. 7, a UE 705 and a Generic IP Network are used710. FIG. 9 illustrates another embodiment in which a UE 905, aFemtocell access point (FAP) 910, and a Generic IP Network 915 are usedto connect the Local Node 805 with the MSC 720 through the GANC 715.

As shown, the protocol layers of the GANC 880-885 are communicativelycoupled (shown with arrows 845-850 respectively) with theircorresponding layers in the Generic IP Network 915. Similarly, the GANClayers 855-875 are communicatively coupled (shown with arrows 820-840respectively) with their corresponding layers in the FAP 910. Also theMM layer 890 and CC/CS/SMS layers 895 of the MSC 720 are transparentlyconnected (shown with arrows 810-815 respectively) to theircorresponding layers in the UE 905. Using this technique, the FAPsimilar to the FAP 235 shown in FIG. 2 can be utilized to connect a UE(such as UEs 270-275) to the wireless core network 220 through a networkcontroller 210. A person of ordinary skill in the art would be able toapply the technique shown in FIGS. 8 and 9 to communicatively couple anyuser equipment, access points, terminal adaptors, SoftMobiles, etc.(such as the ones shown in FIG. 2) to an integrated communication system(ICS) that uses a multi-layer CS domain control architecture as shown inFIG. 7.

b) CS Domain—Control Plane—UE Architecture

FIG. 10 illustrates the UE architecture for the CS domain control plane.As shown, the architecture includes support for GERAN, UTRAN, and bothA/Gb mode GAN and Iu mode GAN. The main features of the UE CS DomainControl Plane architecture shown in FIG. 10 are as follows. The GERANRR-SAP interface 1015 to the GSM-MM layer 1005 is preserved identicallyfor both GERAN and A/Gb-mode GAN access. Likewise, the UTRAN RR-SAPinterface 1020 to the GSM-MM layer 1005 is preserved identically forboth UTRAN and Iu-mode GAN access. An access mode switch 1010 isprovided to switch between GERAN/UTRAN, A/GB-mode GAN and Iu-mode GANmodes. GA-CSR/GA-RC 1025 peers directly with the UTRAN RRC 1030 andGERAN RRC 1035 layers to provide coordination for roving and handover.As shown in FIG. 10, GA-CSR/GA-RC 1025, UTRAN RRC 1030, and GERAN RRC1035 interface through a set of service access interfaces (SAPs) 1040.

2. CS Domain—User Plane

FIG. 11 illustrates the GAN protocol architecture in support of the CSdomain user plane in some embodiments. The figure shows differentprotocol layers for the UE 1105, Generic IP Network 1110, GANC 1115, andMSC 1120. FIG. 11 also shows the two interfaces Up 1125 and Iu-cs 1130.The main features of the GAN CS domain user plane architecture are asfollows. The underlying Access Layers 1135 and Transport IP layer 1140provide the generic connectivity between the UE 1105 and the GANC 1115.The IPSec layer 1145 provides encryption and data integrity. The CS userplane data transport over the Up interface 1125 is the same as the CSuser plane for A/Gb-mode GAN (i.e., using the Real Time Protocol, RTP,per IETF RFC 3267. The GANC 1115 interworks the CS domain user planebetween RTP/UDP and the Iu User Plane (Iu-UP) protocol on the Iu-csinterface 1130. In some embodiments, the Iu-cs Data transport layers1165 are per 3GPP TS 25.414 standard.

A person of ordinary skill in the art would realize that other userequipments, access point, terminal adaptor, SoftMobiles, etc. can beconnected to the core network through a GANC. For instance, FIG. 12illustrates the CS domain, user plane protocol architecture of a UE1205, a Femtocell access point (FAP) 1210, and Generic IP Network 1215.Using the technique described in conjunction with FIGS. 8 and 9, aperson of ordinary skill in the art would be able to replace the UE 1105and Generic IP Network 1110 shown in FIG. 11 with the UE 1205, FAP 1210,and Generic IP Network 1215 to connect the Femtocell UE 1205 to the corenetwork through the GANC. Similarly, other types of UE, access points,terminal adaptors, SoftMobiles, etc. can be connected to the corenetwork through the GANC.

b) CS Domain—User Plane—UE Architecture

FIG. 13 illustrates the UE architecture for the CS domain user plane insome embodiments. As shown, the architecture includes support for bothA/Gb mode and Iu mode GAN 1305, as well as GERAN 1310, and UTRAN 1315.The RFC 3267 AMR Processing layer 1320 is utilized for connecting theGAN RTP/UDP/IP layers 1325 to the AMR Audio Processing layer 1330through the CS User Plane Routing Service layer 1335, which routes CSuser plane data to and from the selected access network; i.e., GERAN,UTRAN, or GAN. The RFC 3267 AMR Processing layer 1320 is not used whenconnecting to the CS Data Processing layer 1340; i.e., in the case ofcircuit switched data, as opposed to circuit switched voice.

B. Packet Switched (PS) Domain

1. PS Domain—Control Plane

FIG. 14 illustrates the GAN architecture in support of the PS DomainControl plane. The figure shows different protocol layers for the UE1405, Generic IP Network 1410, GANC 1415, SGSN 1420. FIG. 14 also showsthe two interfaces Up 1425 and Iu-ps 1430. The main features of the GANPS domain control plane architecture shown in FIG. 14 are as follows.The underlying Access Layers 1435 and Transport IP layer 1440 providethe generic connectivity between the UE 1405 and the GANC 1415. TheIPSec layer 1445 provides encryption and data integrity. TCP 1450provides reliable transport for the GA-PSR between UE 1405 and GANC1415. The GA-RC manages the IP connection, including the GANregistration procedures. The Generic Access Packet Switched Resource(GA-PSR) protocol supports UMTS-specific requirements.

The GANC 1415 terminates the GA-PSR protocol and inter-works it to theRANAP protocol 1455 over the Iu-ps interface 1430. NAS protocols 1460,such as for GMM, SM and SMS, are carried transparently between the UE1405 and SGSN 1420. In some embodiments, the Iu-ps signaling transportlayers 1465 are per 3GPP TS 25.412.

A person of ordinary skill in the art would realize that other userequipments, access point, terminal adaptor, SoftMobiles, etc. can beconnected to the core network through a GANC. For instance, FIG. 15illustrates the PS domain, control plane protocol architecture of a UE1505, a Femtocell access point (FAP) 1510, and Generic IP Network 1515.Using the technique described in conjunction with FIGS. 8 and 9, aperson of ordinary skill in the art would be able to replace the UE 1405and Generic IP Network 1410 shown in FIG. 11 with the UE 1505, FAP 1510,and Generic IP Network 1515 to connect the Femtocell UE 1505 to the corenetwork through the GANC. Similarly, other types of UE, access points,terminal adaptors, SoftMobiles, etc. can be connected to the corenetwork through the GANC.

c) PS Domain—Control Plane—UE Architecture

FIG. 16 illustrates the UE architecture for the PS domain control planein some embodiments. As shown, the architecture includes support forboth A/Gb mode and Iu mode GAN, as well as GERAN and UTRAN. The mainfeatures of the UE PS Domain Control Plane architecture shown in FIG. 16are as follows. The GERAN GRR-SAP interface 1615 and GERAN GMMRR-SAPinterface 1617 to the GMM layer 1605 is preserved identically for bothGERAN and A/Gb-mode GAN access. Likewise, the UTRAN RABMAS-SAP interface1620 and UTRAN GMMAS-SAP interface 1622 to the GMM layer 1605 ispreserved identically for both UTRAN and Iu-mode GAN access. An accessmode switch 1610 is provided to switch between GERAN/UTRAN, A/GB-modeGAN and Iu-mode GAN modes. GA-PSR/GA-RC 1625 peers directly with theUTRAN RRC 1630 and GERAN RRC 1635 layers to provide coordination forroving and handover. As shown in FIG. 16, GA-PSR/GA-RC 1625, UTRAN RRC1630, and GERAN RRC 1635 interface through a set of service accessinterfaces (SAPs) 1640.

2. PS Domain—User Plane

FIG. 17 illustrates the GAN architecture for the PS Domain User Plane insome embodiments. The figure shows different protocol layers for the UE1705, Generic IP Network 1710, GANC 1715, SGSN 1720. FIG. 17 also showsthe two interfaces Up 1725 and Iu-ps 1730. The main features of the GANPS domain user plane architecture shown in FIG. 17 are as follows. Theunderlying Access Layers 1735 and Transport IP layer 1740 provide thegeneric connectivity between the UE 1705 and the GANC 1715. The IPSeclayer 1745 provides encryption and data integrity.

GA-PSR is extended to include support for the GTP-U G-PDU message formatto transport PS User Data (e.g., IP packets), rather than LLC PDUs as inA/Gb mode GAN. As shown in FIG. 17, user data in GTP-U G-PDU messagesmay be carried transparently between the UE 1705 and core networkthrough the SGSN to the GGSN. In some embodiments, the Iu-ps datatransport lower layers 1765 are per 3GPP TS 25.414 standard.

FIG. 18 illustrates an alternative GAN PS domain user planeconfiguration which is supported by the Up interface procedures of someembodiments. In this configuration, the GANC 1815 terminates the Upinterface GTP-U tunnel with the UE 1805 and also terminates the separateIu-ps GTP-U tunnel to the SGSN 1820. The GANC 1815 relays the PS userdata between the Up interface GTP-U tunnel and the associated Iu-psinterface GTP-U tunnel to allow the PS user data to flow between the UEand the SGSN.

This configuration minimizes the number of active GTP-U “paths”presented to the core network; i.e., the SGSN may be limited in thenumber of RNCs with which it can concurrently exchange PS user data(e.g., today, there can be no more than 4096 RNCs in a given PLMN). Itmay not be able to support-without a software upgrade, forexample—concurrent communication with hundreds of thousands of UEs aswould be required if the GTP-U tunnels were from UE to SGSN. Terminatingthe Iu-ps GTP-U tunnels on the GANC avoids this potential SGSNlimitation. In some embodiments, the Iu-ps data transport lower layers1865 are per 3GPP TS 25.414 standard.

A person of ordinary skill in the art would realize that other userequipments, access point, terminal adaptor, SoftMobiles, etc. can beconnected to the core network through a GANC. For instance, FIG. 19illustrates the PS domain, user plane protocol architecture of a UE1905, a Femtocell access point (FAP) 1910, and Generic IP Network 1915.Using the technique described in conjunction with FIGS. 8 and 9, aperson of ordinary skill in the art would be able to replace the UE 1805and Generic IP Network 1810 shown in FIG. 11 with the UE 1905, FAP 1910,and Generic IP Network 1915 to connect the Femtocell UE 1905 to the corenetwork through the GANC. Similarly, other types of UE, access points,terminal adaptors, SoftMobiles, etc. can be connected to the corenetwork through the GANC.

a) PS Domain—User Plane—UE Architecture

FIG. 20 illustrates the UE architecture for the PS domain user plane insome embodiments. As shown, the architecture includes support for bothA/Gb mode and Iu mode GAN 2005, as well as GERAN 2010, and UTRAN 2015.An access mode switch 2020 is provided to switch between GERAN/UTRAN,A/GB-mode GAN and Iu-mode GAN modes.

C. GA-RC (Generic Access Resource Control)

The GA-RC protocol provides a resource management layer, with thefollowing functions. Discovery and registration with GANC, registrationupdate with GANC, application level keep-alive with GANC; and supportfor identification of the AP being used for GAN access.

1. States of the GA-RC Sub-Layer

FIG. 21 illustrates the state diagram for generic access in the UE insome embodiments. As shown, the GA-RC sub-layer in the UE can be in oneof two states: GA-RC-DEREGISTERED 2105 or GA-RC-REGISTERED 2110. Thefollowing outcomes are possible when switching (shown by arrow 2112) theserving RR to Iu-mode GAN: (1) Transition to GA-CSR-IDLE 2115 andGA-PSR-IDLE 2120 (i.e., if the UE is idle during the transition), (2)Transition to GA-CSR-CONNECTED 2125 and GA-PSR-IDLE 2130 (i.e., due toCS handover or relocation), (3) Transition to GA-CSR-IDLE 2115 andGA-PSR-CONNECTED 2130 (i.e., due to PS handover or relocation), (4)Transition to GA-CSR-CONNECTED 2125 and GA-PSR-CONNECTED 2130 (i.e., dueto dual transfer mode handover or CS+PS relocation). The switch of theserving RR from GAN to GERAN/UTRAN RRC (shown by arrow 2135) may occurwhen the UE is in any combination of the GA-CSR and GA-PSR states.

In the GA-RC-DEREGISTERED state 2105, the UE may be in a GAN coveragearea; however, the UE has not registered successfully with the GANC. TheUE may initiate the GAN Registration procedure when in theGA-RC-DEREGISTERED state 2105. The UE returns to GA-RC-DEREGISTEREDstate 2105 on loss of TCP or IPSec connection or on execution of the GANDe-registration procedure.

In the GA-RC-REGISTERED state 2110, the UE is registered with theServing GANC. The UE has an IPSec tunnel and a TCP connectionestablished to the Serving GANC through which the UE may exchange GA-RC,GA-CSR, and GA-PSR signaling messages with the GANC.

While the UE remains in the GA-RC-REGISTERED state 2110 it performsapplication level keep-alive with the GANC. In the GA-RC-REGISTEREDstate 2110, the UE may be in either UTRAN/GERAN mode or GAN mode. The UEmay either (1) be camped on GERAN or UTRAN and idle, (2) be active inGERAN or UTRAN (e.g., a GSM RR or a UTRAN RRC connection may beestablished), (3) have “roved in” to GAN mode, or (4) have recently“roved out” of GAN mode (e.g., due to handover from GAN).

D. GA-CSR (Generic Access Circuit Switched Resources)

The GA-CSR protocol provides a circuit switched services resourcemanagement layer which supports the following functions: (1) setup oftransport channels for CS traffic between the UE and GANC, (2) CShandover support between UTRAN/GERAN and GAN, (3) direct transfer of NASmessages between the UE and the core network, and (4) other functionssuch as CS paging and security configuration.

1. States of the GA-CSR Sub-Layer

The GA-CSR sub-layer in the UE can be in two states, GA-CSR-IDLE orGA-CSR-CONNECTED as illustrated in FIG. 21. The UE enters theGA-CSR-IDLE state 2115 when the UE switches the serving RR entity toGAN. This switch may occur only when the GA-RC is in theGA-RC-REGISTERED state 2110.

The UE moves from the GA-CSR-IDLE state 2115 to the GA-CSR-CONNECTEDstate 2125 when the GA-CSR connection is established and returns toGA-CSR-IDLE state 2115 when the GA-CSR connection is released. UponGA-CSR connection release, an indication that no dedicated CS resourcesexist is passed to the upper layers. The UE may also enter theGA-CSR-CONNECTED state 2125 while in the GA-RC-REGISTERED state 2110 inGERAN/UTRAN mode when Handover to GAN is being performed. In the sameway, the UE enters the GA-RC-REGISTERED state 2110 in GERAN/UTRAN modefrom the GA-CSR-CONNECTED state 2125 when Handover from GAN issuccessfully executed.

E. GA-PSR (Generic Access Packet Switched Resources)

The GA-PSR protocol provides a packet switched services resourcemanagement layer which supports the following functions: (1) setup oftransport channels for PS traffic between the UE and network, (2) PSrelocation/handover support between UTRAN/GERAN and GAN, (3) directtransfer of NAS messages between the UE and the PS core network, (4)transfer of GPRS user plane data, and (5) other functions such as PSpaging and security configuration.

1. States of the GA-PSR Sub-Layer

The GA-PSR sub-layer in the UE can be in two states, GA-PSR-IDLE orGA-PSR-CONNECTED as illustrated in FIG. 21. The UE enters theGA-PSR-IDLE state 2120 when the UE switches the serving RR entity toGAN. This switch may occur only when the GA-RC is in theGA-RC-REGISTERED state 2110. The UE moves from the GA-PSR-IDLE state2120 to the GA-PSR-CONNECTED state 2130 when the GA-PSR connection isestablished and returns to GA-PSR-IDLE state 2120 when the GA-PSRconnection is released. Upon GA-PSR connection release, an indicationthat no dedicated resources exist is passed to the upper layers.

The UE may also enter the GA-PSR-CONNECTED state 2130 while in theGA-RC-REGISTERED state 2110 in GERAN/UTRAN mode when Handover to GAN isbeing performed. In the same way, the UE enters the GA-RC-REGISTEREDstate 2110 in GERAN/UTRAN mode from the GA-PSR-CONNECTED state 2130 whenHandover from GAN is successfully executed. The GA-PSR Packet TransportChannel (GA-PSR PTC) provides the association between the UE and GANCfor the transport of GPRS user data over the Up interface. It isdescribed in PS NAS Signaling Procedures in sub-section V.P, below.

IV. GAN SECURITY MECHANISMS

GAN supports security mechanisms at different levels and interfaces asdepicted in FIG. 22. The security mechanisms 2205 over the Up interfaceprotect control plane and user plane traffic flows between the UE 2210and the GANC 2215 from unauthorized use, data manipulation andeavesdropping; i.e., authentication, encryption and data integritymechanisms are supported.

Network access security 2220 includes the mechanisms defined in “3GSecurity; Security Architecture”, 3GPP TS 33.102 standard. Mutualauthentication of the subscriber and the core network (CN) 2225 occursbetween the MSC/VLR or SGSN and the UE and is transparent to the GANC.However, there is a cryptographic binding between the UE-CNauthentication and the UE-GANC authentication to preventman-in-the-middle attacks.

Additional application level security mechanisms 2230 may be employed inthe PS domain to secure the end-to-end communication between the UE 2210and the application server 2235. For example, in some embodiments the UE2210 may run the HTTP protocol over an SSL session for secure webaccess.

All control plane and user plane traffic sent between the UE 2210 andthe GANC 2215 over the Up interface is protected by an IPSec tunnelbetween the UE 2210 and GANC-SEGW, that provides mutual authentication(using USIM credentials), encryption and data integrity using the samemechanisms as specified in “3G security; Wireless Local Area Network(WLAN) interworking security”, 3GPP TS 33.234.

As described above (in relation to FIGS. 9, 12, 15, and 19), someembodiments utilize a Femtocell access point (FAP) to communicativelycouple a user equipment UE to the GANC via a Generic IP Network. Asshown in FIG. 9, the FAP architecture for the CS control plane has anIPSec layer 920. Similarly the FAP architectures for the CS user plane,PS control plane, and PS user plane architectures also include IPSec (orIPSec ESP) layers (1220, 1520, and 1920 respectively). As shown in FIGS.9, 12, 15, and 19, these IPSec layers are over the transport IP layerand Remote IP layers of the GANC and are communicatively coupled totheir corresponding GANC IPSec layers, thereby providing a secured linkbetween the GANC and the FAP.

V. HIGH-LEVEL PROCEDURES

A. Mode Selection in Multi-Mode Terminals

A Generic Access capable UE can support any IP access technology inaddition to the UTRAN and possibly GERAN radio interfaces. The UE can beeither in the GERAN/UTRAN mode or in GAN mode of operation. The UE canbe configured to operate in one of the two modes (i.e., GERAN/UTRAN orGAN) at any given time. There may be a preferred mode of operation thatcan be configured by the subscriber or by the service provider throughvarious mechanisms, e.g. device management.

On power up, the UE always starts in GERAN/UTRAN mode and executes thenormal power-up sequence. The UE in some embodiments executes thepower-up sequence as specified in “Non-Access-Stratum functions relatedto Mobile Station (MS) in idle mode”, 3GPP TS 23.122 standard. Followingthis, the UE may switch into GAN mode based on mode selection preferencedetermined by user preferences or operator configuration.

The various preferences for the UE that are possible are as follows:GERAN/UTRAN-only, GERAN/UTRAN-preferred, GAN-preferred, and GAN-only. InGERAN/UTRAN-only, the UE RR entity remains in GERAN/UTRAN mode and doesnot switch to GAN mode. In GERAN/UTRAN-preferred, the UE RR entity is inGERAN/UTRAN mode as long as there is a PLMN available and not forbiddenthrough GERAN/UTRAN. If no allowable PLMN is available throughGERAN/UTRAN, and UE has successfully registered with a GAN over thegeneric IP access network, then the UE switches to GAN mode. When a PLMNbecomes available over GERAN/UTRAN and the PLMN is not forbidden, or theUE has de-registered or lost connectivity with the GAN over the genericIP access network, the UE returns to GERAN/UTRAN mode.

In GAN-preferred, when the UE has successfully registered with the GANover the generic IP access network, the UE switches to GAN mode andstays in this mode as long as the GAN is available. When the UEderegisters, or otherwise loses connectivity with the GAN over thegeneric IP access network, the UE switches to GERAN/UTRAN mode.

In GAN-only, the UE switches to GAN mode (after initial power upsequence in GERAN/UTRAN mode to obtain cellular network information, butexcluding MM and GMM procedures with GERAN/UTRAN core network) and doesnot switch to GERAN/UTRAN mode. During the initial power up sequence inGERAN/UTRAN mode the UE shall ignore all paging messages receivedthrough the GERAN/UTRAN network.

B. PLMN Selection

In some embodiments, there are no changes from the PLMN selectionprocedures in the NAS layers (MM and above) in the UE, with theexception that in GAN mode the “in VPLMN background scan” is disabled. AGANC can only be connected to one PLMN. The PLMN selection in the NASlayers does not lead to a change of mode between GERAN/UTRAN mode andGAN mode. For a specific instance of PLMN selection, only PLMNsavailable via GAN or only PLMNs available via GERAN/UTRAN are providedto the NAS layer (i.e., no combination of the PLMNs available viaGERAN/UTRAN and GAN).

In the case of a GAN capable UE, some embodiments require a GANCselection process as part of the process of establishing theconnectivity between the UE and the GANC. This takes place when, duringGAN registration, a GAN capable UE may have a choice among two or moreGANC-PLMN pairs indicated by the Default GANC (i.e., in the GA-RCREGISTER REDIRECT message). The GANC selection process takes place whilethe UE is still in GERAN/UTRAN mode, and before the UE roves into GANmode. If the current selected PLMN is available via GAN, it shall beselected. If not, the selection of GANC is implementation specific.

If the UE does not have any stored information related to the ServingGANC for the cell or AP to which the UE is currently connected, the UEattempts to register with the Default GANC (always located in the HPLMN)stored in UE. The UE includes an indication, identifying the GANC as theDefault GANC in the GA-RC REGISTER REQUEST message.

When a UE attempts to register on the Default GANC including anindication that it is in automatic PLMN selection mode one of thefollowings happens. If the Default GANC decides to serve the UE, theDefault GANC responds with a GA-RC REGISTER ACCEPT message. When theDefault GANC decides to redirect the UE to another GANC within theHPLMN, the Default GANC responds with a GA-RC REGISTER REDIRECT message,not including a list of PLMN identities.

When the Default GANC decides to redirect the UE to a PLMN that is notthe HPLMN, the Default GANC responds with a GA-RC REGISTER REDIRECTmessage and includes a list of PLMNs that may provide GAN service to theUE in its current location. The list contains one or more PLMNidentities along with the identities of their associated GANC and SEGWnodes (either in IP address or FQDN format). Following the GANCselection process, the GA-RC entity in the UE attempts to register onthe associated GANC.

If at any time the user wishes to perform manual PLMN selection or a“User reselection” irrespective of whether the UE is in manual orautomatic PLMN selection mode, the UE sends a GA-RC REGISTER REQUESTmessage to the Default GANC, including an indication that it is inmanual PLMN selection mode. The Default GANC is not allowed to acceptthe registration and responds with a GA-RC REGISTER REDIRECT message andincludes a list of PLMNs that may provide GAN service to the UE in itscurrent location.

When the UE includes the identity of the current serving GSM network inthe GA-RC REGISTER REQUEST message, the Default GANC uses this toidentify the list of PLMNs to send to the ULE in the response message.

After successful registration with a serving GANC, the UE does not storethe PLMN list. The UE does not use the PLMN list, provided to the UEduring the registration procedure, for background scanning. A UE cannotuse GA in a VPLMN unless the HPLMN supports and authorizes GA.

C. Re-Selection Between GERAN/UTRAN and GAN Modes

1. Rove-in (from GERAN/UTRAN Mode to GAN Mode)

This procedure is applicable only when GAN service is available, a UE isnot in NC2 mode (applicable if the UE is in GERAN mode and as defined in“Radio subsystem link control”, 3GPP TS 45.008 standard) and has a UEpreference for GAN-only, GAN-preferred or, if no allowable PLMN isavailable through GERAN/UTRAN, for GERAN/UTRAN-preferred.

Following successful GAN registration, the access mode in the UE isswitched to GAN mode. The GA-CSR entity in the UE provides theNAS-related system information received in the GAN RegistrationProcedure to the NAS layers. The NAS considers the GANC-allocated cellidentity as the current serving cell.

While in GAN mode, GERAN-RR and UTRAN RRC entities are detached from theRR-SAP in the UE. As a result the entities do not: (1) inform NAS aboutany GERAN/UTRAN cell re-selection and/or the change of systeminformation of the current camping cell, (2) inform NAS about any newlyfound PLMN over GERAN or UTRAN, and (3) act on any paging requestmessage received over GERAN or UTRAN.

2. Rove-Out (from GAN Mode to GERAN/UTRAN Mode)

This procedure is applicable when the UE detaches from the generic IPaccess network, and its mode selection is GAN-preferred orGERAN/UTRAN-preferred. When the UE detaches from the generic IP accessnetwork, depending on prevailing circumstances the UE may be able toderegister first with the GANC.

For the GAN-preferred and GERAN/UTRAN-preferred mode selections, the UEdetaches the GA-CSR entity from the RR-SAP and re-attaches the GERAN-RRor UTRAN RRC entity to the RR-SAP and restores normal GERAN-RR or UTRANRRC functionality. For the GAN-only mode selection, GA-CSR remainsattached to the NAS and the UE stays in GAN mode (i.e., in “No Service”condition).

D. GAN Registration Related Procedures

1. Discovery and Registration for Generic Access

The Discovery and Registration procedures are applicable only if the UEpreference is operating in GAN-only, GAN-preferred or, if no allowablePLMN is available through GERAN/UTRAN, in GERAN/UTRAN-preferred mode.

Once the UE has established a connection to the generic IP accessnetwork, the UE determines the appropriate GANC-SEGW to connect to, bycompleting the Discovery Procedure to the Provisioning GANC in the HPLMNof the UE. The Provisioning GANC provides the address of the DefaultGANC in the HPLMN of the UE, to which the UE can register.

The UE attempts to register on the Default GANC provided by theProvisioning GANC during the Discovery procedure, by completing theRegistration Procedure. The Default GANC may accept the Registration;redirect the UE to another GANC; or reject the Registration.

a) Security Gateway Identification

The USIM of the UE contains the FQDN (or IP address) of the ProvisioningGANC and the associated SEGW or the UE derives this information based oninformation in the USIM. When the UE does not have any information aboutother GANCs and associated SEGW stored, then the UE completes theDiscovery procedure towards the Provisioning GANC. As part of theRegistration Procedure, the Default GANC can indicate whether this GANCand SEGW address or the address of a GANC that the UE is beingredirected to, may be stored by the UE.

The UE can also store Serving GANC information for Serving GANCs withwhich the UE was able to complete a successful registration procedure.The default GANC is in control of whether the UE is allowed to storeServing GANC information. When there is no GERAN/UTRAN coverage in theAP location, the stored Serving GANC information is associated with theAP-ID. When there is GERAN/UTRAN coverage in the AP location, the storedServing GANC information is associated with the GSM CGI or LAI or UTRANCI. The stored Serving GANC information is: (1) serving SEGW FQDN or IPaddress following successful registration, (2) serving GANC FQDN or IPaddress following successful registration, and (3) optionally, ServingGANC TCP port following successful registration and if returned from thenetwork. Different embodiments store different number of such entries inthe UE is implementation specific. Only the last successfully registeredGANC association is stored when the Default GANC indicates that the UEis allowed to store these addresses. A UE may preferentially join ageneric IP access network point of attachment whose association with aServing GANC has been stored in memory.

On connecting to the generic IP access network, when the UE has a storedServing GANC for the AP-ID or the GERAN/UTRAN cell, the UE attempts toregister with the associated Serving GANC in its memory. The GANC maystill reject the UE for any reason even though it may have served the UEbefore. The UE deletes from its stored list the address of the ServingGANC on receiving a registration reject or if the registration fails forany other reason (e.g., not receiving any response).

If the UE does not receive a response to the Registration Request sentto the Serving GANC (and which is not the Default GANC), the UEre-attempt to register with the Default GANC. If the UE does not receivea response to the registration request sent to the Default GANC, itattempts the discovery procedure with the Provisioning GANC to obtain anew Default GANC.

In the case when a UE is attempting to register or discover a GANC afterfailing to register on a GANC, the UE provides in the Registration orDiscovery procedure an indication that the UE has attempted to registeron another GANC, the failure reason, and the GANC and SEGW addresses ofthe failed registration. When the UE connects to a generic IP accessnetwork, for which the UE does not have a stored Serving GANC in it'smemory, the UE attempt to register with the Default GANC.

b) GANC Capabilities

GANC specific information is transferred to the UE on successfulregistration.

c) UE Capabilities

GAN specific capabilities of the UE are transferred to the GANC duringregistration.

d) Required GAN Services

The UE may request which GAN services it requires from the GANC as partof the Registration procedures.

e) GAN Mode Selection

The UE (i.e., with Iu-mode GAN support) transfers its GAN Mode Supportinformation to the GANC during Discovery and Registration procedures;i.e., in the GAN Classmark IE. GAN Mode Support options are A/Gb modesupported, Iu mode supported, or both modes supported. When no GAN ModeSupport information is received, the GANC assumes that the UE supportsA/Gb mode operation only.

The provisioning GANC may use the received GAN Mode Support informationto assign the UE to an appropriate default GANC (e.g., if separate A/Gbmode and Iu-mode GANCs are deployed in the network) or to an appropriateTCP port on the default GANC (e.g., if separate TCP ports are used forA/Gb mode and Iu-mode GAN service). The Iu-mode capable GANC alsoindicates the GAN mode to use for the current session in the GAN ModeIndicator IE; this allows the UE to determine the Iu-mode capability ofthe Home PLMN.

Table 1 enumerates the discovery handling for the various combinationsof UE and Home PLMN GAN mode capabilities.

TABLE 1 GAN Mode Selection procedures associated with GAN Discovery UEGAN Mode Home PLMN GAN Mode Capabilities Capabilities A/Gb only Iu onlyBoth A/Gb only GANC: Handle as GANC: No GAN GANC: No GAN normal A/Gbmode Mode Support Mode Support discovery information providedinformation provided UE: Proceed with or A/Gb mode (only) or A/Gb mode(only) A/Gb mode indicated by UE, indicated by UE, registrationtherefore Reject therefore handle as (Unspecified) normal A/Gb mode UE:Retry on next discovery. Assign UE power-on to A/Gb-capable GANC. UE:Proceed with A/Gb mode registration Iu only GANC: Handle as GANC: IuMode GANC: Iu Mode normal A/Gb mode Support (only) Support (only)discovery indicated by UE, indicated by UE, UE: No GAN Mode thereforeaccept and therefore accept and Selection provided by send GAN Mode sendGAN Mode GANC, therefore abort Indicator = Iu Indicator = Iu. Assign GANoperation and UE: Proceed with Iu UE to Iu-capable retry on nextpower-on mode registration GANC. UE: Proceed with Iu mode registrationBoth GANC: Handle as GANC: Support for GANC: Support for normal A/Gbboth modes indicated both modes indicated discovery by UE, therefore byUE, therefore UE: No GAN Mode accept and send GAN accept and send GANSelection provided by Mode Indicator = Iu Mode Indicator = Iu. GANC,therefore UE: Proceed with Iu Assign UE to Iu- proceed with Iu mode moderegistration capable GANC. registration (Note 1) UE: Proceed with Iumode registration

Note: As described in Table 2 below, the result of Iu mode registrationof a A/Gb-capable UE on a A/Gb-capable GANC is that the UE is placed inA/Gb mode.

In some embodiments, the default or serving GANC uses the received GANMode Support information to redirect the UE to a different GANC or adifferent TCP port on the current GANC. The Iu-mode capable GANC alsoindicates the GAN mode to use for the current session in the GAN ModeIndicator IE.

Table 2 enumerates the registration handling for the variouscombinations of UE and Home PLMN GAN mode capable.

TABLE 2 GAN Mode Selection procedures associated with GAN RegistrationUE GAN Mode Default/Serving GANC GAN Mode Capabilities Capabilities A/Gbonly Iu only Both A/Gb only GANC: Handle as GANC: No GAN GANC: No GANnormal A/Gb mode Mode Support Mode Support registration informationprovided information provided UE: Proceed per A/Gb or A/Gb mode (only)or A/Gb mode (only) mode GAN procedures indicated by UE, indicated byUE, therefore Reject therefore handle as (Invalid GANC) normal A/Gb modeUE: Attempt registration. If registration with required, redirect UEDefault GANC or re- to A/Gb-capable discovery (per A/Gb GANC. mode GANUE: Proceed per A/Gb procedures) mode GAN procedures Iu only GANC:Handle as GANC: Iu Mode GANC: Iu Mode normal A/Gb mode Support (only)Support (only) registration indicated by UE, indicated by UE, UE: No GANMode therefore accept and therefore accept and Selection provided bysend GAN Mode send GAN Mode GANC, therefore Indicator = Iu Indicator =Iu. Deregister and treat as UE: Proceed per Iu UE: Proceed per Iuregister reject (Invalid mode GAN procedures mode GAN procedures GANC)Both GANC: Handle as GANC: Support for GANC: Support for normal A/Gbboth modes indicated both modes indicated registration by UE, thereforeby UE, therefore UE: No GAN Mode accept and send GAN accept and send GANSelection provided by Mode Indicator = Iu Mode Indicator = Iu or GANC,therefore UE: Proceed per Iu A/Gb (see Note 1 proceed per A/Gb mode GANprocedures below). If required, mode GAN procedures redirect UE to Iu orA/Gb-capable GANC. UE: Proceed per Iu or A/Gb mode GAN procedures

Note 1: The GANC's choice of Iu-mode versus A/Gb-mode may be based onother information received in the GAN registration message from the UE,information stored in the GANC, and on operator (i.e., service provider)policy; e.g., if the GSM RR/UTRAN RRC State IE indicates that the UE isin GERAN Dedicated mode, the UE location is an area without UTRANcoverage and the operator wants to minimize inter-RAT handovers, theGANC may direct the UE to use A/Gb mode.

f) Discovery Procedure

When a UE supporting GAN first attempts to connect to a GAN, the UEneeds to identify the Default GANC. Each GAN capable UE can beconfigured with the FQDN (or IP address) of the Provisioning GANC andthe associated SEGW or the UE can derive this FQDN based on informationin the USIM (see “Numbering, addressing and identification”, 3GPP TS23.003 standard). The UE first connects to a Provisioning GANC-SEGW andGANC in the HPLMN of the UE, by establishing a secure IPSec tunnel and aTCP connection using the provisioned or derived addresses. The UEobtains the FQDN or IP address of the Default GANC in the HPLMN and theassociated SEGW, through the Discovery procedure.

If no GERAN/UTRAN coverage is available when a UE connects to the GANCfor GAN service, then the GANC cannot necessarily determine the locationof the UE for the purposes of assigning the UE to the correct servingGANC (e.g., to enable handover and location-based services). The GANCpermits the operator to determine the service policy in this case; e.g.,the operator could provide service to the user with certain limitations(possibly with a user interface indication on the UE). When the UEinitiates the Discovery/Registration procedures and no GERAN/UTRANcoverage is available, the GANC may have insufficient information tocorrectly route subsequent emergency calls.

FIG. 23 illustrates the Discovery procedure in some embodiments. Thefigure shows different messages exchanges between the UE 2305, DNS 2310,the provisioning GANC 2315, the security gateway SEGW 2320 associatedwith the provisioning GANC 2315, and the DNS server 2325 associated withthe provisioning GANC 2315. In the description below it is assumed thatthe UE 2305 has a mode selection of GAN-only or GAN-preferred orGERAN/UTRAN-preferred and that the UE has already connected to thegeneric IP access network. Different embodiments deem different signallevels as sufficient for triggering the GAN Discovery and Registrationprocedures. The following steps are taken during Discovery procedure insome embodiments.

As shown in FIG. 23, when the UE 2305 has a provisioned or derived FQDNof the Provisioning SEGW, the UE performs (in Step 1) a DNS query (viathe generic IP access network interface) to resolve the FQDN to an IPaddress. When the UE has a provisioned IP address for the ProvisioningSEGW, the DNS step is omitted. Next, the DNS Server 2310 returns (inStep 2) a response including the IP Address of the Provisioning SEGW2320.

As shown, the UE 2305 establishes (in Step 3) a secure tunnel to theProvisioning SEGW 2320. When the UE 2305 has a provisioned or derivedFQDN of the Provisioning GANC 2315, the UE 2305 performs (in Step 4) aDNS query (via the secure tunnel) to the DNS server 2325 associated withthe provisioning GANC 2315 to resolve the FQDN to an IP address. Whenthe UE 2305 has a provisioned IP address for the Provisioning GANC, theDNS step will be omitted. The DNS Server 2325 returns (in Step 5) aresponse including the IP Address of the Provisioning GANC 2315.

The UE 2305 sets up a TCP connection to a well-defined port on theProvisioning GANC 2315. It then queries (in Step 6) the ProvisioningGANC 2315 for the Default GANC, using GA-RC DISCOVERY REQUEST. Themessage contains: (1) Cell Info: Either current camping UTRAN/GERAN cellID or the last LAI where the UE successfully registered, along with anindicator stating which one it is, (2) Generic IP access networkattachment point information: AP-ID, as defined in Identifiers in GAN,sub-section VII, below, (3) UE Identity: IMSI, and (4) GAN Classmark:Including indications of A/Gb Mode supported and Iu Mode supported.

Next, the Provisioning GANC 2315 returns (in Step 7) the GA-RC DISCOVERYACCEPT message, using the information provided by the UE (e.g. the cellID), to provide the FQDN or IP address of the Default GANC and itsassociated Default SEGW. This is done so the UE is directed to a “local”Default GANC in the HPLMN to optimize network performance. The GANC Portthat the UE must use for registration may be included. The GAN ModeIndicator may be included as described in GAN Mode Section, sub-sectionabove.

When the Provisioning GANC 2315 cannot accept the GA-RC DISCOVERYREQUEST message, it returns (in Step 8) a GA-RC DISCOVERY REJECT messageindicating the reject cause. The secure IPSec tunnel to the ProvisioningSEGW 2320 is released (in Step 9). It is possible to reuse the sameIPSec tunnel for GAN Registration procedures. In this case the IPSectunnel is not released.

g) Registration Procedure—Normal Case

Following the Discovery procedure the UE establishes a secure tunnelwith the security gateway of the Default GANC, provided by theProvisioning GANC in the Discovery procedure, and attempts to registerwith the Default GANC. The Default GANC may become the Serving GANC forthat connection by accepting the registration, or the Default GANC mayredirect a UE performing registration to a different Serving GANC.

GANC redirection may be based on information provided by the UE duringthe Registration procedure, operator chosen policy or network loadbalancing. The GAN Registration procedure serves the followingfunctions: (1) Ensures the UE is registered to the appropriate GANCentity; i.e., with use of the redirection process, (2) Informs the GANCthat the UE is now connected through a generic IP access network and isavailable at a particular IP address. The GANC maintains theregistration context for the purposes of (for example) mobile-terminatedcalling, (3) Provides the UE with the operating parameters associatedwith the GAN service. The “System Information” message content that isapplicable to the GAN cell is delivered to the UE during the GANregistration process. This enables the UE to switch to GAN mode, andfollowing the Registration procedure trigger NAS procedures with thecore network (such as Location/Routing Area Update, mobile originatedcalls, mobile terminated calls, etc.), and (4) Enables the UE to requestwhich GAN services are required.

FIG. 24 illustrates Registration procedure in some embodiments. Thefigure shows different messages exchanges between the UE 2405, DNS 2410,the provisioning GANC 2415, the security gateway SEGW 2420 associatedwith the provisioning GANC 2415, and the DNS server 2425 associated withthe provisioning GANC 2415. The following steps are done duringRegistration procedure.

As shown in FIG. 24, when the UE 2405 was provided the FQDN of theDefault or Serving SEGW, the UE performs (in Step 1) a DNS query (viathe generic IP access network interface) to resolve the FQDN to an IPaddress. When the UE has a provisioned IP address for the SEGW, the DNSstep is omitted. The DNS Server 2410 returns (in Step 2) a response.

As shown, the UE 2405 sets up (in Step 3) a secure IPSec tunnel to theSEGW 2420. This step may be omitted if an IPSec tunnel is being reusedfrom an earlier Discovery or Registration. When the UE 2405 was providedthe FQDN of the Default or Serving GANC, the UE then performs (in Step4) a DNS query (via the secure tunnel) to resolve the FQDN to an IPaddress. When the UE has an IP address for the GANC, the DNS step isomitted. Next, the DNS Server 2425 returns (in Step 5) a response.

The UE 2405 then sets up a TCP connection to a TCP port on the GANC. TheTCP port can either be a well-known port or one that has been earlierreceived from the network during Discovery or Registration. The UE 2405attempts (in Step 6) to register on the GANC by transmitting the GA-RCREGISTER REQUEST. The message includes: (1) Cell Info: Either currentcamping UTRAN/GERAN cell ID, or last LAI where the UE successfullyregistered, along with an indicator stating which one it is, (2) GenericIP access network attachment point information: AP-ID, as defined inIdentifier in GAN, Section VII, below, (3) UE Identity: IMSI, (4) UECapability Information, (5) GAN Services Required, (6) GAN Classmark:Including indications of A/Gb Mode supported, Iu Mode supported.

When the GANC 2415 accepts the registration attempt, the GANC 2415responds (in Step 7) with a GA-RC REGISTER ACCEPT. In this case the TCPconnection and the secure IPSec tunnel are not released and aremaintained as long as the UE is registered to this GANC.

The GA-RC REGISTER ACCEPT message includes (1) GAN CapabilityInformation and (2) GAN specific system information which includes (a)GAN Mode Indicator: A/Gb Mode GAN or Iu Mode GAN, (b) Cell descriptionof the GAN cell, (c) Location-area identification comprising the mobilecountry code, mobile network code, and location area code correspondingto the GAN cell, (d) Cell identity identifying the cell within thelocation area corresponding to the GAN cell, and (e) Applicable systemtimer values (e.g., for the application-level keep alive messagetransmission interval, see Keep Alive sub-section, below)

Alternatively, the GANC 2415 may reject the request. In this case, theGANC 2415 responds (in Step 8) with a GA-RC REGISTER REJECT indicatingthe reject cause. The TCP connection and the secure IPSec tunnel arethen released.

Alternatively, if the GANC 2415 decides to redirect the UE to (another)Serving GANC, the GANC 2415 responds (in Step 9) with a GA-RC REGISTERREDIRECT providing the FQDN or IP address of the target Serving GANC andthe associated SEGW, and the GAN Mode Indicator if the GANC requiresthat a particular mode be used with the Serving GANC (e.g., if the GANCknows that the Serving GANC supports only A/Gb mode GAN). In this casethe TCP connection is released and the secure IPSec tunnel is optionallyreleased (in Step 10) depending on if the network indicates that thesame IPSec tunnel can be reused for the next registration. The GA-RCREGISTER REDIRECT message may contain: (1) a single Serving SEGW andGANC address or (2) a list of PLMN identities and associated ServingSEGW and GANC addresses. The message also may contain an Indication ofwhether GANC address(es) can be stored in the UE for future use.

a) Registration procedure—abnormal cases

When the Serving GANC rejects the Register request and does not provideredirection to another Serving GANC, the UE re-attempts Registration tothe Default GANC including a cause that indicates the failedregistration attempt and the Serving GANC and SEGW with which theRegister request failed. The UE also deletes all stored informationabout this Serving GANC.

When the Default GANC rejects a Registration Request and is unable toprovide redirection to suitable Serving GANC, the UE may re-attempt theDiscovery procedure to the Provisioning GANC (including a causeindicating the failed registration attempt and the Default GANC providedin the last Discovery procedure). The UE also deletes all storedinformation about the Default GANC.

2. De-Registration

FIG. 25 illustrates De-Registration initiated by the UE 2505 in someembodiments. The GA-RC De-Registration procedure allows the UE 2505 toexplicitly inform the GANC 2510 that it is leaving GAN mode (e.g., whenit detaches from the generic IP access network), by sending (in Step 1)a GA-RC DEREGISTER message to the GANC 2510, allowing the GANC 2510 tofree resources that it assigned to the UE 2505. The GANC 2510 alsosupports “implicit GAN de-registration”, when the TCP connection to theUE is abruptly lost.

FIG. 26 illustrates De-Registration initiated by the GANC 2610 in someembodiments. As shown, the GANC 2610 can autonomously release the UEregistration context, and send (in Step 1) a GA-RC DEREGISTER message tothe UE 2605. Alternatively, the GANC 2610 can implicitly deregister theUE 2605 by closing the TCP connection with the UE. At power-down theGA-RC sublayer of the UE ensures that the UE explicitly detaches fromthe network, where possible, before completing the GA-RC De-Registrationprocedure.

3. Registration Update

FIG. 27 illustrates Registration Update in some embodiments. The GA-RCRegistration Update procedure allows the UE 2705 to update informationin the GANC 2710 regarding changes to the identity of the overlappingGERAN cell or changes to the generic IP access network point ofattachment. As shown, the UE 2705 sends (in Step 1) a GA-RC REGISTERUPDATE UPLINK message to the GANC 2710 carrying the updated information.This may result in the UE 2705 being redirected to another serving GANC,or being denied service; e.g., due to operator policy.

When the UE 2705 detects UTRAN/GERAN coverage after reporting nocoverage during GAN registration, the UE sends the GA-RC REGISTER UPDATEUPLINK to the GANC with the updated information. Whenever the generic IPaccess network point of attachment changes, the UE sends a GA-RCREGISTER UPDATE UPLINK to the GANC with the updated generic IP accessnetwork point of attachment information. When the UE requires to updatethe GANC with a new list of GAN Services required, then the UE sendsGA-RC REGISTER UPDATE UPLINK message to the GANC including the new GANServices Required list.

The GANC 2710 may optionally send (in Step 2) the GA-RC REGISTERREDIRECT when it decides to redirect the UE based on updatedinformation. The GANC 2710 may also optionally deregister the ULE 2705on receiving an update by sending (in Step 3) GA-RC DEREGISTER to theUE.

FIG. 28 illustrates Registration Update Downlink procedure in someembodiments. The GAN Registration Update procedure also allows the GANC2810 to update the GAN system information in the UE 2805, if needed, bysending (in Step 1) a GA-RC REGISTER UPDATE DOWNLINK message to the UEcarrying the updated information.

4. Keep Alive

FIG. 29 illustrates the Keep Alive process in some embodiments. The KeepAlive process is a mechanism between the peer GA-RC entities to indicatethat the UE is still registered to the GANC. Using periodictransmissions (in Step 1) of the GA-RC KEEP ALIVE message the UE 2805 inturn determines that the GANC 2810 is still available using thecurrently established lower layer connection.

5. Cell Broadcast Information

FIG. 30 illustrates the Cell Broadcast Information mechanism of someembodiments. The Cell Broadcast Information is a mechanism between thepeer GA-RC entities, allowing the GANC to pass the UE informationrelating to the Cell Broadcast Services. The UE 3005 includes GANService Required information in the GA-RC REGISTER REQUEST and GA-RCREGISTER UPDATE UPLINK messages passed to the GANC, indicating that theUE requires the Cell Broadcast Service. The GANC 3010 then passes (inStep 1) the required information to the UE 1105 in the GA-RC CELLBROADCAST INFO message.

E. Authentication

The Up interface supports the ability to authenticate the UE with theGANC (for the purposes of establishing the secure tunnel) using GSM orUMTS credentials. Authentication between UE and GANC is performed usingEAP-SIM or EAP-AKA within IKEv2.

F. Encryption and Integrity Protection

All control and user plane traffic over the Up interface is sent throughthe pair of IPSec ESP tunnel mode security associations (one for eachdirection) that are established during the establishment of the IKEv2security association. Encryption and integrity protection are via thenegotiated cryptographic algorithms, based on core network policy,enforced by the GANC-SEGW.

G. GA-CSR Connection Handling

The Iu-mode GAN GA-CSR connection is a logical connection between the UEand the GANC for the CS domain. A GA-CSR connection is established whenthe upper layers in the UE request the establishment of a CS domainsignaling connection and the UE is in GA-CSR-IDLE state; i.e., no GA-CSRconnection exists. When a successful response is received from thenetwork, GA-CSR replies to the upper layer that the CS domain signalingconnection is established and the UE has entered the equivalent of theRRC connected mode (i.e., the GA-CSR-CONNECTED state).

1. GA-CSR Connection Establishment

FIG. 31 illustrates successful and unsuccessful establishment of theGA-CSR Connection in some embodiments. As shown, the UE 3105 initiatesGA-CSR connection establishment by sending (in Step 1) the GA-CSRREQUEST message to the GANC 3110. This message contains theEstablishment Cause indicating the reason for GA-CSR connectionestablishment.

When GANC determines that the connection request can be accepted, theGANC 3110 signals the acceptance of the connection request to the UE3105 by sending (in Step 2) the GA-CSR REQUEST ACCEPT and the UE entersthe GA-CSR-CONNECTED state. On the other hand, when the GANC determinesthat the GA-CSR connection request has to be rejected, the GANC 3110sends (in Step 3) a GA-CSR REQUEST REJECT to the UE 3105 indicating thereject cause, completing the procedure.

2. GA-CSR Connection Release

FIG. 32 illustrates release of the logical GA-CSR connection between theUE and the GANC in some embodiments. As shown, the MSC 3215 indicates tothe GANC 3210 to release the CS resources allocated to the UE, bysending (in Step 1) the RANAP Iu Release Command message to the GANC3210.

Next, the GANC 3210 confirms (in Step 2) resource release to MSC 3215using the Iu Release Complete message. The GANC 3210 then commands (inStep 3) the UE 3205 to release resources, using the GA-CSR RELEASEmessage. Finally, the UE 3205 confirms (in Step 4) resource release tothe GANC using the GA-CSR RELEASE COMPLETE message and the GA-CSR statein the UE changes to GA-CSR-IDLE.

H. CS Security Mode Control

FIG. 33 illustrates the message flow for security mode control in someembodiments. As shown, the MSC 3315 sends (in Step 1) the RANAP SecurityMode Command message to GANC 3310. This message contains the integritykey (IK) and allowed algorithms, and optionally the encryption key (CK)and allowed algorithms.

Next, the GANC 3310 sends (in Step 2) the GA-CSR SECURITY MODE COMMANDmessage to the UE 3305. This message indicates the integrity protectionand encryption settings (i.e., that are applicable after relocation toUTRAN), and a random number. The UE stores the information for possiblefuture use after a relocation to UTRAN.

Next, the UE 3305 computes a MAC based on the random number, the UE IMSIand the integrity key calculated by the UE. The MAC or “messageauthentication code” allows the GANC to verify that the UE has been ableto calculate the same integrity key value as the GANC received from theMSC, thereby preventing certain “man-in-the-middle” security attacks.The UE 3305 then sends (in Step 3) the GA-CSR SECURITY MODE COMPLETEmessage to the GANC 3310 to signal its selected algorithm and thecomputed MAC.

The GANC 3310 then verifies the MAC using the random number, the UE IMSIand the integrity key provided by the MSC in Step 1. When the GANCverifies the MAC to be correct (i.e., the GANC-calculated MAC is thesame as the UE-calculated MAC) it sends (in Step 4) the Security ModeComplete message to the MSC 3315. The MAC proves that the identity thatis authenticated to the GANC is the same as the identity authenticatedto the core network.

I. CS NAS SIGNALING PROCEDURES

After GA-CSR connection establishment, NAS signaling may be transferredfrom MSC-to-UE and from UE-to-MSC.

1. MSC-to-UE NAS Signaling

FIG. 34 illustrates MSC-to-UE NAS signaling in some embodiments. Asshown, for MSC-to-UE NAS signaling, the MSC 3415 sends (in Step 1) a NASPDU to the GANC via the RANAP Direct Transfer message. The GANC 3410encapsulates the NAS PDU within a GA-CSR DL DIRECT TRANSFER message andforwards (in Step 2) the message to the UE 3405 via the existing TCPconnection.

2. UE-to-MSC NAS Signaling

FIG. 35 illustrates UE-to-MSC NAS signaling in some embodiments. Asshown, the UE 3505 receives a request from the NAS layer to transfer anuplink NAS PDU. Assuming that the required signaling connection alreadyexists, the UE 3505 encapsulates the NAS PDU within a GA-CSR UL DIRECTTRANSFER message and sends (in Step 1) the message to the GANC 3510. TheGANC 3510 relays (in Step 2) the received message to the MSC 3515 viathe RANAP Direct Transfer message.

J. Mobile Originated CS Call

1. GANC Terminates Iu UP Protocol

FIG. 36 illustrates steps performed during a mobile originated CS callin some embodiments. The procedure assumes that the UE is in GAN mode;i.e., it has successfully registered with the GANC and GA-CSR is theserving RR entity for CS services in the UE. It also assumes that noGA-CSR signaling connection exists between the UE and GANC (i.e.,GA-CSR-IDLE state). As shown, the GA-CSR Connection Establishmentprocedure is performed (in Step 1). In some embodiments, this procedureis performed as described in GA-CSR Connection Establishmentsub-section, above. Next, the UE 3605 sends the CM Service Requestmessage to the GANC 3610 within the GA-CSR UL DIRECT TRANSFER message.

Next, the GANC 3610 establishes an SCCP connection to the MSC 3615 andforwards (in Step 3) the NAS PDU (i.e., the CM Service Request message)to the MSC 3615 using the RANAP Initial UE Message. The message includesthe Domain Indicator set to value ‘CS domain’. Subsequent NAS messagesbetween the UE and MSC will be sent between GANC and MSC using the RANAPDirect Transfer message.

The MSC 3615 may optionally authenticate (in Step 4) the UE usingstandard UTRAN authentication procedures. The MSC 3615 may optionallyinitiate (in Step 5) the Security Mode Control procedure described in CSSecurity Mode Control sub-section, above. The UE 3605 sends (in Step 6)the Setup message providing details on the call to the MSC and itsbearer capability and supported codecs. This message is contained withinthe GA-CSR UL DIRECT TRANSFER between the UE and the GANC. The GANCforwards the Setup message to the MSC.

Next, the MSC 3615 indicates (in Step 7) it has received the call setupand it will accept no additional call-establishment information usingthe Call Proceeding message to the GANC. The GANC forwards (in Step 7)this message to the UE in the GA-CSR DL DIRECT TRANSFER message.

The MSC 3615 requests (in Step 8) the GANC 3610 to assign call resourcesusing the RANAP RAB Assignment Request message. The MSC 3615 includesthe RAB-ID, the CN Transport Layer Address and the CN Iu TransportAssociation for user data, and an indication that Iu UP support mode isrequired, among other parameters.

The GANC 3610 then sends (in Step 9) the GA-CSR ACTIVATE CHANNEL messageto the UE 3605 including bearer path setup information such as: (1)Channel mode, (2) Multi-rate codec configuration, (3) UDP port & the IPaddress for the uplink RTP stream, and (4) Voice sample size.

Next, the UE 3605 sends (in Step 10) the GA-CSR ACTIVATE CHANNEL ACK tothe GANC 3610 indicating the UDP port for the downlink RTP stream. SinceIu UP support mode is indicated by the MSC in step 8, the GANC 3610sends (in Step 11) the Iu UP INITIALIZATION packet to the MSC.

In response, the MSC responds (in Step 12) with the Iu UP INITIALIZATIONACK packet. The GANC 3610 signals (in Step 13) the completion of the RABestablishment to the UE 3605 with the GA-CSR ACTIVATE CHANNEL COMPLETEmessage. Alternatively, Steps 11 and 12 may occur before Step 9.

The GANC 3610 signals to the MSC 3615 that the RAB has been establishedby sending (in Step 14) a RANAP RAB Assignment Response message. The MSC3615 signals to the UE 3505, with the Alerting message, that the calledparty is ringing. The message is transferred (in Step 15) to the GANC3610 and GANC forwards (in Step 15) the message to the UE 3605 in theGA-CSR DL DIRECT TRANSFER. When the UE has not connected the audio pathto the user, it generates ring back to the calling party. Otherwise, thenetwork-generated ring back will be returned to the calling party.

Next, the MSC 3615 signals that the called party has answered, via theConnect message. The message is transferred (in Step 16) to the GANC3610 and GANC forwards (in Step 16) the message to the UE in the GA-CSRDL DIRECT TRANSFER. The UE connects the user to the audio path. If theUE is generating ring back, it stops and connects the user to the audiopath.

The UE 3605 then sends (in Step 17) the Connect Ack message in response,and the two parties are connected for the voice call. This message iscontained within the GA-CSR UL DIRECT TRANSFER between the UE and theGANC. The GANC forwards the Connect Ack message to the MSC. At thistime, bi-directional voice traffic flows (in Step 18) between the UE3605 and MSC 3615 through the GANC 3610.

2. UE Terminates Iu UP Protocol

Some embodiments utilize an alternative procedure for a mobileoriginated CS call. FIG. 37 illustrates steps performed during a mobileoriginated CS call in these embodiments. The procedure assumes that theUE is in GAN mode; i.e., it has successfully registered with the GANCand GA-CSR is the serving RR entity for CS services in the UE. It alsoassumes that no GA-CSR signaling connection exists between the UE andGANC (i.e., GA-CSR-IDLE state). Steps 1 to 8 are performed the same asdescribed for steps 1 to 8 shown in FIG. 36 above and are not repeatedfor simplicity.

Since Iu UP support mode is indicated by the MSC in step 8 (as describedin reference with FIG. 36), the GANC indicates (in Step 9) that Iu UPsupport mode is required in the GA-CSR ACTIVATE CHANNEL message, and theUE 3705 sends (in Step 10) the Iu UP INITIALIZATION packet to the MSC3715. In response, the MSC 3715 responds (in Step 11) with the Iu UPINITIALISATION ACK packet. Next, the UE 3705 sends (in Step 12) theGA-CSR ACTIVATE CHANNEL ACK to the GANC 3710.

The GANC 3710 signals to the MSC 3715 that the RAB has been establishedby sending (in Step 13) a RANAP RAB Assignment Response message. TheGANC 3710 also sends (in Step 14) a GA-CSR ACTIVATE CHANNEL COMPLETEmessage to the UE 3705. Steps 15 to 18 are performed the same asdescribed for steps 15 to 18 shown in FIG. 36 above and are not repeatedfor simplicity.

K. Mobile Terminated CS Call

FIG. 38 illustrates steps performed during a mobile terminated CS callin some embodiments. The description of the procedure assumes that theUE is in GAN mode; i.e., it has successfully registered with the GANCand GA-CSR is the serving RR entity for CS services in the UE. It alsoassumes that no GA-CSR signaling connection exists between the UE andGANC (i.e., the UE is in the GA-CSR-IDLE state). When amobile-terminated call arrives at the MSC 3815, as shown in FIG. 38, theMSC 3815 sends (in Step 1) a RANAP Paging message to the GANC 3810identified through the last Location Update received by it and includesthe TMSI if available. The IMSI of the mobile being paged is alwaysincluded in the request.

Next, the GANC 3810 identifies the UE registration context using theIMSI provided by the MSC 3815. It then pages (in Step 2) the UE 3805using the GA-CSR PAGING REQUEST message. The message includes the TMSI,if available in the request from the MSC; else it includes only the IMSIof the UE.

The UE 3805 responds with a GA-CSR PAGING RESPONSE. The UE transitionsto the GA-CSR CONNECTED state. The GANC 3810 establishes an SCCPconnection to the MSC 3815. The GANC 3810 then forwards (in Step 4) thepaging response to the MSC 3815 using the RANAP Initial UE Message.Subsequent NAS messages between the UE and core network will be sentbetween GANC and MSC using the RANAP Direct Transfer message.

The MSC 3815 may optionally authenticate (in Step 5) the UE 3805 usingstandard UTRAN authentication procedures. The MSC may optionally update(in Step 6) the security configuration in the UE, via the GANC, asdescribed in CS Security Mode Control sub-section above.

The MSC 3815 then initiates (in Step 7) call setup using the Setupmessage sent to the UE via GANC. GANC forwards (in Step 7) this messageto the UE 3805 in the GA-CSR DL DIRECT TRANSFER message.

Next, the UE 3805 responds with Call Confirmed using the GA-CSR ULDIRECT TRANSFER after checking it's compatibility with the bearerservice requested in the Setup and modifying the bearer service asneeded. When the Setup included the signal information element, the UEalerts the user using the indicated signal, otherwise the UE alerts theuser after the successful configuration of the user plane. The GANC 3810forwards (in Step 8) the Call Confirmed message to the MSC 3815.

Next, the MSC 3815 initiates the assignment procedure with the GANC3810, which triggers (in Step 9) the setup of the RTP stream (voicebearer channel) between the GANC and UE, same as steps 8-14 in themobile originated CS call scenario described above.

The UE 3805 then signals (in Step 10) that it is alerting the user, viathe Alerting message contained in the GA-CSR UL DIRECT TRANSFER. TheGANC forwards (in Step 10) the Alerting message to the MSC. The MSCsends a corresponding alerting message to the calling party.

The UE 3805 then signals (in Step 11) that the called party hasanswered, via the Connect message contained in the GA-CSR UL DIRECTTRANSFER. The GANC 3810 forwards (in Step 11) the Connect message to theMSC 3815. The MSC sends a corresponding Connect message to the callingparty and through connects the audio. The UE connects the user to theaudio path.

Next, the MSC 3815 acknowledges (in Step 12) via the Connect Ack messageto the GANC 3810. GANC forwards (in Step 12) this message to the UE 3805in the GA-CSR DL DIRECT TRANSFER. The two parties on the call areconnected on the audio path. At this time, bi-directional voice trafficflows (in Step 13) between the UE and MSC through the GANC.

L. CS Call Clearing

FIG. 39 illustrates call clearing initiated by the UE in someembodiments. As shown, the UE 3905 sends (in Step 1) the Disconnectmessage to the MSC 3915 to release the call. This message is containedin the GA-CSR UL DIRECT TRANSFER message between UE 3905 and GANC 3910.The GANC 3910 forwards (in Step 1) the Disconnect message to the MSC(i.e., using the RANAP Direct Transfer message).

Next, the MSC 3915 responds (in Step 2) with a Release message to theGANC. The GANC forwards (in Step 2) this message to the UE 3905 usingthe GA-CSR DL DIRECT TRANSFER message. The UE 3905 responds (in Step 3)with the Release Complete message. This message is contained within theGA-CSR UL DIRECT TRANSFER message between UE and GANC. The GANC forwards(in Step 3) the Disconnect message to the MSC. The MSC triggers (in Step4) the release of connection as described in GA-CSR connection releasesub-section, above.

M. CS Handover

1. CS Handover from GERAN to GAN

a) GANC Terminates Iu UP Protocol

FIG. 40 illustrates CS handover from GERAN to GAN in some embodiments.The description of the GERAN to GAN handover procedure assumes thefollowing: (1) the UE is on an active call on the GERAN, (2) the UE modeselection is GAN-preferred, or if GERAN/UTRAN-preferred, the RxLev fromthe current serving cell drops below a defined threshold. In someembodiments, this threshold can be specified as a fixed value, orprovided by the GERAN BSS to the UE in dedicated mode, (3) the UE hassuccessfully registered with a GANC, allowing the UE to obtain GANsystem information, and (4) the GERAN provides information onneighboring 3G cells such that one of the cells in the 3G neighbor listmatches the 3G cell information associated with the GANC, as provided inthe AS-related component of the system information obtained from theGANC. As shown, the UE 4005 begins to include GAN cell information inthe Measurement Report message to the GERAN BSC 4015. The UE 4005reports the highest signal level for the GAN cell. This is not theactual measured signal level on GAN, rather an artificial value (e.g.,RxLev=63), allowing the UE to indicate preference for the GAN.

Based on UE measurement reports and other internal algorithms, the GERANBSC 4015 decides to handover to the GAN cell. The BSC 4015 starts thehandover preparation by sending (in Step 2) a Handover Required messageto the MSC 4020, identifying the target 3G RNC (GANC).

The MSC 4020 requests (in Step 3) the target GANC 4010 to allocateresources for the handover using the Relocation Request message. The UEis identified by the included IMSI parameter.

Since Iu UP support mode is indicated, the GANC 4010 sends (in Step 4)the Iu UP INITIALISATION packet to the MSC. The MSC responds (in Step 5)with the Iu UP INITIALISATION ACK packet.

The GANC 4010 builds a Handover to UTRAN Command message and sends it(in Step 6) to the MSC 4020 through the Relocation Request Acknowledgemessage. The MSC forwards (in Step 7) the Handover to UTRAN Commandmessage to the GERAN BSC 4015 in the BSSMAP Handover Command message,completing the handover preparation.

Next, the GERAN BSC 4015 sends (in Step 8) the Intersystem to UTRANHandover Command message, containing the Handover to UTRAN Commandmessage, to the UE 4005 to initiate handover to GAN. The UE does notswitch its audio path from GERAN to GAN until handover completion (i.e.,until it sends the GA-CSR HANDOVER COMPLETE message) to keep the audiointerruption short.

The UE 4005 accesses (in Step 9) the GANC 4010 using the GA-CSR HANDOVERACCESS message, and provides the entire Intersystem to UTRAN HandoverCommand message received from GERAN. The GANC 4010 sends (in Step 10)the GA-CSR ACTIVATE CHANNEL message to the UE 4005 including bearer pathsetup information such as: (1) Channel mode, (2) Multi-rate codecconfiguration, (3) UDP port & the IP address for the uplink RTP stream,and (4) Voice sample size.

Next, the UE 4005 sends (in Step 11) the GA-CSR ACTIVATE CHANNEL ACK tothe GANC 4010 indicating the UDP port for the downlink RTP stream. TheGANC 4010 signals (in Step 11) the completion of the RAB establishmentto the UE 4005 with the GA-CSR ACTIVATE CHANNEL COMPLETE message.

The UE 4005 transmits (in Step 13) the GA-CSR HANDOVER COMPLETE messageto indicate the completion of the handover procedure at its end. Itswitches the user from the GERAN user plane to the GAN user plane. TheGANC 4010 indicates (in Step 14) to the MSC 4020 that it has detectedthe UE, using Relocation Detect message. The CN can optionally nowswitch the user plane from the source GERAN to the target GAN.

Bi-directional voice traffic is now (in Step 15) flowing between the UE4005 and MSC 4020, via GANC 4010. The target GANC 4010 indicates (inStep 16) the handover is complete, using the Relocation Completemessage. If it had not done so before, the CN now switches the userplane from source GERAN to target GAN.

The CN tears down (in Step 17) the connection to the source GERAN, usingClear Command message. Finally, the source GERAN 4015 confirms (in Step18) the release of GERAN resources allocated for this call, using ClearComplete message.

b) UE Terminates Iu UP Protocol

Some embodiments utilize an alternative procedure for CS handover fromGERAN to GAN. FIG. 41 illustrates steps performed during GERAN to GAN inthese embodiments. The description of the GERAN to GAN handoverprocedure assumes the following: (1) the UE is on an active call on theGERAN, (2) the UE mode selection is GAN-preferred, or ifGERAN/UTRAN-preferred, the RxLev from the current serving cell dropsbelow a defined threshold. In some embodiments, this threshold can bespecified as a fixed value, or provided by the GERAN BSS to the UE indedicated mode, (3) the UE has successfully registered with a GANC,allowing the UE to obtain GAN system information, and (4) the GERANprovides information on neighboring 3G cells such that one of the cellsin the 3G neighbor list matches the 3G cell information associated withthe GANC, as provided in the AS-related component of the systeminformation obtained from the GANC. Steps 1 to 3 are performed the sameas described for steps 1 to 3 shown in FIG. 40 above and are notrepeated for simplicity.

The GANC 4110 sends (in Step 4) the GA-CSR ACTIVATE CHANNEL message tothe UE 4105 including bearer path setup information such as: (1) Channelmode, (2) Multi-rate codec configuration, (3) UDP port & the IP addressfor the uplink RTP stream, (4) Voice sample size, and an indication thatIu UP support mode is required. In some embodiments, the GANC 4110includes the Radio Access Bearer (RAB) parameters, and the Iu UPparameters (e.g., Iu UP mode, where support mode is used for AMR voicecalls).

Since Iu UP support mode is indicated, the UE 4110 sends (in Step 5) theIu UP INITIALISATION packet to the IP address and UDP port indicated inthe GA-CSR ACTIVATE CHANNEL message.

The MSC 4115 responds (in Step 6) with the Iu UP INITIALISATION ACKpacket. The MSC 4115 sends the message to the source IP address and UDPport number of the received INITIALISATION packet. The UE 4105 sends (inStep 7) the GA-CSR ACTIVATE CHANNEL ACK to the GANC 4110. The GANC 4110builds a Handover to UTRAN Command message and sends (in Step 8) it tothe CN 4115 through the Relocation Request Acknowledge message.

The GANC 4110 signals (in Step 9) the completion of the RABestablishment to the UE 4105 with the GA-CSR ACTIVATE CHANNEL COMPLETEmessage. An end-to-end audio path now exists between the UE 4105 and theMSC 4115. The MSC 4115 forwards (in Step 10) the Handover to UTRANCommand message to the GERAN BSC 4120 in the BSSMAP Handover Commandmessage, completing the handover preparation.

The GERAN BSC 4120 sends (in Step 11) the Intersystem to UTRAN HandoverCommand message, containing the Handover to UTRAN Command message, tothe UE to initiate handover to GAN. The UE does not switch its audiopath from GERAN to GAN until handover completion (i.e., until it sendsthe GA-CSR HANDOVER COMPLETE message) to keep the audio interruptionshort.

The UE accesses the GANC 4110 using (in Step 12) the GA-CSR HANDOVERACCESS message, and provides the entire Intersystem to UTRAN HandoverCommand message received from GERAN. The GANC 4110 indicates (in Step13) to the MSC 4115 that it has detected the UE, using Relocation Detectmessage. The MSC 4115 can optionally now switch the user plane from thesource GERAN to the target GAN. Bi-directional voice traffic is nowflowing (in Step 14) between the UE and MSC 4115, via GANC 4110.

The UE transmits (in Step 15) the GA-CSR HANDOVER COMPLETE message toindicate the completion of the handover procedure at its end. Itswitches the user from the GERAN user plane to the GAN user plane.

The target GANC 4110 indicates (in Step 16) the handover is complete,using the Relocation Complete message. If it had not done so before, theMSC 4115 now switches the user plane from source GERAN to target GAN.

Finally, the MSC 4115 tears (in Step 17) down the connection to thesource GERAN, using Clear Command message. The source GERAN confirms (inStep 18) the release of GERAN resources allocated for this call, usingClear Complete message.

2. CS Handover from UTRAN to GAN

a) GANC Terminates Iu UP Packet

FIG. 42 illustrates CS handover from UTRAN to GAN in some embodiments.The description of the UTRAN to GAN Handover procedure assumes thefollowing: (1) the UE is on an active call on the UTRAN, (2) the UE hasbeen ordered by the RNC to make inter-frequency measurements (i.e., ifthe GAN cell has been allocated a different frequency value than is usedin the UTRAN), (a) if the UE is in GAN preferred mode with an Event 2Aconfigured, the UE handles parameters associated with the Event 2A in aGAN specific manner (as described in “Radio Resource Control (RRC)protocol specification”, 3GPP TS 25.331 standard, hereinafter “3GPP TS25.331”) for the reporting of the EGAN, (b) when the UE is inGERAN/UTRAN preferred mode and an event 2A has been configured for theGAN cell, the UE shall only send a measurement about the GAN cell, whenthis event is triggered and no UTRAN cells from the neighbor cell listof the UE satisfy the triggering condition of this Event (as describedin 3GPP TS 25.331), (3) the UTRAN provides information on neighboringcells such that one of the cells in the neighbor list matches the cellassociated with the GANC, as provided in the AS-related component of thesystem information obtained from GANC.

As shown in FIG. 42, the UE 4205 begins to include information about aGAN cell in the Measurement Report message sent (in Step 1) to the RNC4215. The UE 4205 reports the highest signal level for the GAN cell.This is not the actual measured signal level on the GAN, rather anartificial value allowing the UE 4205 to indicate preference for theGAN.

Based on UE measurement reports and other internal algorithms, the RNC4215 decides to initiate handover to the GAN cell. The RNC 4215 startsthe preparation phase of the Relocation procedure by sending (in Step 2)a Relocation Required message to the MSC, identifying the target (GAN)cell.

Next, steps 3 to 5 shown in FIG. 42 are performed as described for steps3-5 for GERAN to GAN Handover sub-section, above. The target GANC 4210acknowledges (in Step 6) the handover request message, using RelocationRequest Acknowledge message, indicating it can support the requestedhandover, and including a Physical Channel Reconfiguration message thatindicates the radio channel to which the UE should be directed.

Next, the MSC 4220 sends (in Step 7) the Relocation Command message tothe RNC 4215, completing the relocation preparation. The RNC 4215 sends(in Step 8) the PHYSICAL CHANNEL RECONFIGURATION message to the UE 4205to initiate handover to GAN. The UE does not switch its audio path fromUTRAN to GAN until handover completion (i.e., until it sends the GA-CSRHANDOVER COMPLETE message) to keep the audio interruption short.

Next, Steps 9-16 shown in FIG. 42 are performed similar to Steps 9-16for GERAN to GAN Handover described above. Next, the MSC 4220 tears down(in Step 17) the connection to the source RNC, using Iu Release Command.Finally, the source RNC 4215 confirms (in Step 18) the release of UTRANresources allocated for this call, using Iu Release Complete.

b) UE Terminates Iu UP Packet

Some embodiments utilize an alternative procedure for CS handover fromUTRAN to GAN. FIG. 43 illustrates steps performed during UTRAN to GAN inthese embodiments. As shown, the UE begins to include (in Step 1)information about a GAN cell in the Measurement Report message sent tothe RNC 4320. The UE reports the highest signal level for the GAN cell.This is not the actual measured signal level on the GAN, rather anartificial value allowing the UE to indicate preference for the GAN.

Based on UE measurement reports and other internal algorithms, the RNC4320 decides to initiate handover to the GAN cell. The RNC 4320 startsthe preparation phase of the Relocation procedure by sending (in Step 2)a Relocation Required message to the MSC 4315, identifying the targetGAN cell.

The MSC 4315 requests (in Step 3) the target GANC 4310 to allocateresources for the handover using the Relocation Request message. The UE4305 is identified by the included IMSI parameter.

The GANC 4310 sends (in Step 4) the GA-CSR ACTIVATE CHANNEL message tothe UE 4305 including bearer path setup information received in theRelocation Request message, such as: (1) UDP port & the IP address forthe uplink RTP stream, (2) Radio Access Bearer (RAB) parameters, and (3)Iu UP parameters (e.g., Iu UP mode, where support mode is used for AMRvoice calls).

Since Iu UP support mode is indicated, the UE 4305 sends (in Step 5) theIu UP INITIALISATION packet to the IP address and UDP port indicated inthe GA-CSR ACTIVATE CHANNEL message. This message is routed to the corenetwork 4315 (e.g., the R4 media gateway).

The MSC 4315 responds (in Step 6) with the Iu UP INITIALISATION ACKpacket. The MSC 4315 sends the message to the source IP address and UDPport number of the received INITIALISATION packet. The UE 4305 sends (inStep 7) the GA-CSR ACTIVATE CHANNEL ACK to the GANC 4310.

The target GANC 4310 acknowledges (in Step 8) the handover requestmessage, using Relocation Request Acknowledge message, indicating it cansupport the requested handover, and including a Physical ChannelReconfiguration message that indicates the radio channel to which the UE4305 should be directed.

The GANC 4310 signals (in Step 9) the completion of the RABestablishment to the UE 4305 with the GA-CSR ACTIVATE CHANNEL COMPLETEmessage. An end-to-end audio path now exists between the UE 4305 and theMSC 4315. The MSC 4315 sends (in Step 10) the Relocation Command messageto the RNC 4320, completing the relocation preparation.

The RNC 4320 sends (in Step 11) the PHYSICAL CHANNEL RECONFIGURATIONmessage to the UE to initiate handover to GAN. The UE does not switchits audio path from UTRAN to GAN until handover completion (i.e., untilit sends the GA-CSR HANDOVER COMPLETE message) to keep the audiointerruption short. The UE accesses (in Step 12) the GANC 4310 using theGA-CSR HANDOVER ACCESS message, and provides the entire PHYSICAL CHANNELRECONFIGURATION message received from RNC 4320.

The GANC 4310 indicates (in Step 13) to the MSC 4315 that it hasdetected the UE, using Relocation Detect message. The MSC 4315 canoptionally now switch the user plane from the source RNC 4320 to thetarget GANC 4310. Bi-directional voice traffic is now flowing (in Step14) between the UE and MSC 4315, via GANC 4310.

The UE transmits (in Step 15) the GA-CSR HANDOVER COMPLETE to indicatethe completion of the handover procedure from its perspective. Itswitches the user from the UTRAN user plane to the GAN user plane. Thetarget GANC 4310 indicates (in Step 16) the handover is complete, usingthe Relocation Complete message. If it has not done so before, the CN4315 now switches the user plane from source RNC 4320 to target GANC4310.

Finally, the MSC 4315 tears (in Step 17) down the connection to thesource RNC 4320, using Iu Release Command. The source RNC 4320 confirms(in Step 18) the release of UTRAN resources allocated for this call,using Iu Release Complete.

3. CS Handover from GAN to GERAN

FIG. 44 illustrates the procedure to handover from GAN to GERAN in someembodiments. The procedure description in this sub-clause assumes thefollowing: (1) the UE is on an active call in GAN Iu-mode, and (2) theGERAN becomes available and (a) the UE mode selection isGERAN/UTRAN-preferred, or (b) the UE mode selection is GAN-preferred andthe UE begins to leave GAN coverage, based on its local measurements,received RTCP reports, as well as any uplink quality indicationsreceived from the GANC. The handover from GAN to GERAN procedure isalways triggered by the UE. As shown in FIG. 44, the following steps areperformed during handover from GAN to GERAN.

The GANC 4410 may send (in Step 1) a GA-CSR UPLINK QUALITY INDICATIONwhen there is a problem with the uplink quality for the ongoing call.Uplink Quality Indication is information sent by the GANC to the UEindicating the crossing of an uplink quality threshold in the uplinkdirection. Whenever the UE receives an indication of bad quality, itshould start the handover procedure, as described in the next step.Alternatively, UE can use its local measurements or received RTCPreports, to decide to initiate the handover procedure.

As shown, the UE 4405 sends (in Step 2) the GA-CSR HANDOVER INFORMATIONmessage to the GANC 4410 indicating the Channel Mode and a list oftarget GERAN cells, identified by CGI, in order of preference (e.g.ranked by Cl path loss parameter) for handover, and includes thereceived signal strength for each identified GERAN cell. This list isthe most recent information available from the GSM RR subsystem. Inaddition, the GA-CSR HANDOVER INFORMATION message may include a list oftarget UTRAN cells ranked in order of preference for handover, and thereceived signal strength for each identified UTRAN cell.

If the Serving GANC selects a target GERAN cell, the handover to GERANprocedure is performed. The Serving GANC 4410 starts the handoverpreparation by signaling (in Step 3) to the MSC 4420 the need forhandover, using Relocation Required, and including the GERAN cell listprovided by the UE. The GANC may include only a subset of the cell listprovided by the UE.

The MSC 4420 then selects a target GERAN cell and requests it (in Step4) to allocate the necessary resources, using Handover Request. Thetarget GERAN BSC 4415 builds a Handover Command message providinginformation on the channel allocated and sends it (in Step 5) to the MSC4420 through the Handover Request Acknowledge message.

The MSC 4420 signals (in Step 6) the GANC 4410 to handover the UE 4405to the GERAN, using Relocation Command message, ending the handoverpreparation phase. The GANC transmits (in Step 7) the GA-CSR HANDOVERCOMMAND to the UE including the details sent by the GERAN on the targetresource allocation.

Next, the UE 4405 transmits (in Step 8) the “Um: Handover Access”message containing the handover reference element to allow the targetGERAN BSC 4415 to correlate this handover access with the HandoverCommand message transmitted earlier to the MSC in response to theHandover Required. The target GERAN BSC 4415 confirms (in Step 9) thedetection of the handover to the MSC 4420, using the Handover Detectmessage.

The MSC 4420 may at this point switch (in Step 10) the user plane to thetarget BSS. The GERAN BSC 4415 provides (in Step 11) PhysicalInformation to the UE (i.e., Timing Advance) to allow the UE tosynchronize with the GERAN. The UE 4405 signals (in Step 12) to theGERAN BSC 4415 that the handover is completed, using Handover Complete.

The GERAN BSC 4415 confirms (in Step 13) to the MSC 4420 the completionof the handover, via Handover Complete message. The MSC 4420 may use thetarget CGI used in the Handover procedure for charging purposes.

Bi-directional voice traffic is now flowing (in Step 14) between the UE4405 and MSC 4420, via the GERAN BSC 4415. On receiving the confirmationof the completion of the handover, the MSC 4420 indicates (in Step 15)to the GANC to release any resources allocated to the UE, via the IuRelease Command.

Next, GANC 4415 commands (in Step 16) the UE 4405 to release resources,using the GA-CSR RELEASE message. The GANC 4410 confirms (in Step 17)resource release to MSC 4420 using the Iu Release Complete message.

The UE 4405 confirms (in Step 18) resource release to the GANC 4410using the GA-CSR RELEASE COMPLETE message. The UE 4405 may finallyderegister (in Step 19) from the GANC, using GA-RC DEREGISTER message.

4. CS Handover from GAN to UTRAN

FIG. 45 illustrates the procedure to handover from GAN to UTRAN in someembodiments. The procedure description assumes the following: (1) the UEis on an active call on the GAN, (2) the UE is capable of operating inall of the GAN, GERAN and UTRAN modes, (3) the UTRAN becomes availableand (a) the UE is in GERAN/UTRAN-preferred mode, or (b) the UE modeselection is GAN preferred and begins to leave GAN coverage, based onits local measurements, received RTCP reports, as well as any uplinkquality indications received from the GANC. The handover from GANprocedure is always triggered by the UE. As shown in FIG. 45, thefollowing steps are performed during handover from GAN to UTRAN.

The GANC 4510 may send (in Step 1) a GA-CSR UPLINK QUALITY INDICATION ifthere is a problem with the uplink quality for the ongoing call. UplinkQuality Indication is information sent by the GANC 4510 to the UE 4505indicating the crossing of an uplink quality threshold in the uplinkdirection. Whenever the UE 4505 receives an indication of bad quality,it should start the handover procedure, as described in the next step.Alternatively, UE can use its local measurements or received RTCPreports, to decide to initiate the handover procedure.

Next, the UE 4505 sends (in Step 2) the GA-CSR HANDOVER INFORMATIONmessage to the Serving GANC indicating the Channel Mode and a list ofcandidate target UTRAN and GERAN cells, in order of preference forhandover, and includes the received signal strength for each identifiedcell. The UTRAN cells are identified by the PLMN ID, the LAC and the 3GCell identity (defined in 3GPP TS 25.331).

If the Serving GANC 4510 selects UTRAN as the target RAT, the handoverto UTRAN procedure is performed. The Serving GANC 4510 starts thehandover preparation by signaling (in Step 3) to the MSC 4520 the needfor handover, using Relocation Required and including the UTRAN celllist provided by the UE 4505. The GANC 4510 may include only a subset ofthe cell list provided by the UE 4505.

The MSC 4520 starts the handover procedure towards the target RNC 4515identified by the Serving GANC. The MSC 4520 requests (in Step 4) fromthe target RNC 4515 to allocate the necessary resources using RelocationRequest. The target RNC 4515 builds a Physical Channel Reconfigurationmessage providing information on the allocated UTRAN resources and sendsit (in Step 5) to the MSC 4520 through the Relocation RequestAcknowledge message.

Next, the MSC 4520 signals (in Step 6) the Serving GANC 4510 to handoverthe UE to the UTRAN, using Relocation Command message (which includesthe Physical Channel Reconfiguration message), ending the handoverpreparation phase.

The Serving GANC 4510 transmits (in Step 7) the GA-CSR HANDOVER COMMANDto the UE including the details sent by the UTRAN on the target resourceallocation. Target RNS 4515 achieves (in Step 8) uplink synchronizationon the Uu interface.

The target RNC 4515 confirms (in Step 9) the detection of the handoverto the MSC, using the Relocation Detect message. The MSC 4520 may atthis point switch (in Step 10) the user plane to the target RNS 4515.

Next, the UE 4505 signals (in Step 11) to the UTRAN RNC 4515 that thehandover is completed, using Handover to UTRAN Complete. The UTRAN RNC4515 confirms (in Step 12) to the MSC 4520 the completion of thehandover, via Relocation Complete message. If the user plane has notbeen switched in step 10, the MSC 4520 switches the user plane to thetarget RNS.

Bi-directional voice traffic is now flowing (in Step 13) between the UE4505 and MSC 4520, via the UTRAN RNC 4515. On receiving the confirmationof the completion of the handover, the MSC 4520 indicates (in Step 14)to the Serving GANC 4510 to release any resources allocated to the UE,via the Iu Release Command.

The Serving GANC 4510 then commands (in Step 15) the UE 4505 to releaseresources, using the GA-CSR RELEASE message. The Serving GANC 4510confirms (in Step 16) resource release to MSC 4520 using the Iu ReleaseComplete message.

The UE 4505 confirms (in Step 17) resource release to the Serving GANC4510 using the GA-CSR RELEASE COMPLETE message. The UE 4505 may finallyderegister (in Step 18) from the Serving GANC 4510, using GA-RCDEREGISTER message.

N. GA-PSR Connection Handling

The Iu-mode GA-PSR connection is a logical connection between the ULEand the GANC for the PS domain. A GA-PSR connection is established whenthe upper layers in the UE request the establishment of a PS domainsignaling connection and the UE is in GA-PSR-IDLE state; i.e., no GA-PSRconnection exists. When a successful response is received from thenetwork, GA-PSR replies to the upper layer that the PS domain signalingconnection is established and the UE has entered the equivalent of theRRC connected mode (i.e., the GA-PSR-CONNECTED state).

1. GA-PSR Connection Establishment

FIG. 46 illustrates successful and unsuccessful establishment of theGA-PSR Connection in some embodiments. As shown, the UE 4605 initiatesGA-PSR connection establishment by sending (in Step 1) the GA-PSRREQUEST message to the GANC 4610. This message contains theEstablishment Cause indicating the reason for GA-PSR connectionestablishment. When the GANC 4610 determines that the GA-PSR connectionrequest can be accepted, the GANC 4610 signals the acceptance of theconnection request to the UE 4605 by sending (in Step 2) the GA-PSRREQUEST ACCEPT and the UE enters the GA-PSR-CONNECTED state.Alternatively, when the GANC 4610 determines that the GA-PSR connectionrequest has to be rejected, the GANC 4610 sends (in Step 3) a GA-PSRREQUEST REJECT to the UE ZC05 indicating the reject cause, completingthe procedure.

2. GA-PSR Connection Release

FIG. 47 illustrates release of the logical GA-PSR connection between theUE and the GANC in some embodiments. The following steps are performedduring the release. As shown, the SGSN 4715 indicates to the GANC 4710to release the PS resources allocated to the UE by sending (in Step 1)the RANAP Iu Release Command message to the GANC 4710.

Next, the GANC 4710 confirms (in Step 2) resource release to SGSN 4715using the Iu Release Complete message. Next, the GANC 4710 commands (inStep 3) the UE 4705 to release resources, using the GA-PSR RELEASEmessage. Finally, the UE 4705 confirms (in Step 4) resource release tothe GANC 4710 using the GA-PSR RELEASE COMPLETE message and the GA-PSRstate in the UE changes to GA-PSR-IDLE.

O. PS Security Mode Control

FIG. 48 illustrates the message flow for PS security mode control insome embodiments. As shown, SGSN 4815 sends (in Step 1) the RANAPSecurity Mode Command message to GANC 4810. This message contains theintegrity key (IK) and allowed algorithms, and optionally the encryptionkey (CK) and allowed algorithms.

Next, the GANC 4810 sends (in Step 2) the GA-PSR SECURITY MODE COMMANDmessage to the UE 4805. This message indicates the integrity protectionand encryption settings (i.e., that are applicable after relocation toUTRAN), and a random number. The UE stores the information for possiblefuture use after a relocation to UTRAN.

Next, the UE 4805 computes a message authentication code (MAC) based onthe random number, the UE IMSI and the integrity key calculated by theUE. The UE 4805 then sends (in Step 3) the GA-PSR SECURITY MODE COMPLETEmessage to the GANC 4810 to signal its selected algorithm and thecomputed MAC.

The GANC 4810 then verifies the MAC using the random number, the UE IMSIand the integrity key provided by the SGSN in step 1. When the GANCverifies the MAC to be correct it sends (in Step 4) the Security ModeComplete message to the SGSN 4815. The MAC proves that the identity thatis authenticated to the GANC is the same as the identity authenticatedto the core network.

P. PS NAS Signaling Procedures

After GA-PSR connection establishment, NAS signaling may be transferfrom SGSN-to-UE and from UE-to-SGSN.

1. SGSN-to-UE NAS Signaling

FIG. 49 illustrates SGSN-to-UE PS NAS signaling in some embodiments. Asshown, for SGSN-to-UE NAS signaling, the SGSN 4915 sends (in Step 1) aNAS PDU to the GANC via the RANAP Direct Transfer message. The GANC 4910encapsulates the NAS PDU within a GA-PSR DL DIRECT TRANSFER message andforwards (in Step 2) the message to the UE 4905 via the existing TCPconnection.

2. UE-to-SGSN NAS Signaling

FIG. 50 illustrates UE-to-SGSN NAS signaling in some embodiments. Asshown, the UE 5005 receives a request from the NAS layer to transfer anuplink NAS PDU. Assuming the required signaling connection alreadyexists, the UE 5005 encapsulates the NAS PDU within a GA-PSR UL DIRECTTRANSFER message and sends (in Step 1) the message to the GANC 5010. TheGANC 5010 relays (in Step 2) the received message to the SGSN 5015 thatis currently serving the UE via the RANAP Direct Transfer message.

Q. GA-PSR Packet Transport Channel Management Procedures

The GA-PSR Packet Transport Channel (GA-PSR PTC) provides theassociation between the UE and the network for the transport of GPRSuser data over the Up interface (i.e., via the GAN in Iu-mode). The PTCuses the GTP-U protocol running over UDP transport. The endpointaddresses of the PTC are identified by the IP addresses and UDP portsassigned to the PTC in the UE and network during the PTC activationprocedure. The UDP port number for GTP-U is as defined in “UTRAN Iuinterface data transport & transport signalling”, 3GPP TS 25.414standard, hereinafter “3GPP TS 25.414”.

Multiple PTC instances between a UE and the network may be activated atthe same time, using the same endpoint addresses. Each PTC instance isassigned unique GTP-U Tunnel Endpoint IDs (one on the UE and one on thenetwork) during the activation procedure. The UE and GANC manage theactivation and deactivation of the PTC instances based on the requestsfor data transfer and the configurable PTC Timer.

1. States of the GA-PSR Packet Transport Channel

The UE in the GA-PSR-CONNECTED state can be in one of two PTC substates:PTC-STANDBY or PTC-ACTIVE. The PTC-STANDBY substate is theinitial/default PTC substate of the UE when in the GA-PSR-CONNECTEDstate in GAN mode. The UE is not able to send or receive GPRS user datato or from the network. The UE needs to activate the PTC before sendingany GPRS user data. When the UE successfully establishes a PTC, the UEtransitions to the PTC-ACTIVE substate.

In PTC-ACTIVE substate, the UE is in the GA-PSR-CONNECTED state and thePTC is active between the UE and the network and the UE is able to sendand receive GPRS user data to and from the network. Several events cantrigger the GA-PSR PTC activation on the UE side. These events includethe UE initiates the uplink user data transfer or the GANC initiates PTCactivation; i.e., the UE receives a GA-PSR-ACTIVATE-PTC-REQUEST messagefrom the GANC.

On successful PTC activation and in parallel with transition to thePTC-ACTIVE substate, the UE starts the PTC Timer. When the PTC Timerexpires, the UE sends a message to the GANC to initiate PTCdeactivation. On successful PTC deactivation, the UE transitions toPTC-STANDBY substate.

At any time while in the GA-PSR-CONNECTED state and the PTC-ACTIVEsubstate, the UE may receive the GA-PSR RELEASE message. In addition torequesting release of the GA-PSR session, this is interpreted by the UEas an implicit PTC deactivate command.

At any time while in GAN mode, if the serving RR entity is switched toGSM-RR/UTRAN-RRC, the GA-PSR is disconnected from the GPRS SAPs and theUE enters GERAN/UTRAN mode. Simultaneously, the UE will release theassociated PTC regardless of the PTC Timer status.

The UE GA-PSR entity maintains one PTC for each active PDP context. ThePTC Timer is restarted whenever any uplink user data packet is sent ordownlink user data packet is received related to the PDP context. ThePTC Timer value is provided to the UE as part of the GAN Registrationprocedure (i.e., in the GA-RC REGISTER ACCEPT message).

2. PTC Initial Activation

FIG. 51 depicts the Packet Transport Channel initial activationprocedure, assuming the UE is in the GA-PSR-IDLE state. As shown, thefollowing steps are performed. The GA-PSR Connection Establishmentprocedure is performed (in Step 1) as described in GA-PSR connectionestablishment sub-section, above. The UE 5105 transitions to theGA-PSR-CONNECTED state and the PTC-STANDBY substate. Next, additional PSsignaling procedures are performed (in Step 2). Examples of thesesignaling procedures are illustrated in PDP Context Activation andNetwork Requested PDP Context Activation sub-sections, below.

Next, the SGSN 5115 initiates (in Step 3) the RAB Assignment procedureand includes the RAB-ID, the CN Transport Layer Address (IP address) andthe CN Iu Transport Association (GTP-U Terminal Endpoint Identifier,TEID) for user data. The GANC 5110 sends (in Step 4) the GA-PSR ACTIVATEPTC REQUEST message to the UE to request activation of the PacketTransport Channel. The message includes the RAB-ID, a TEID that the GANCassigns to the UE, and the GANC IP Address and GANC TEID. If the GANC isconfigured to allow the UE to send PTC packets (i.e., GTP-U messages)directly to the SGSN (i.e., the configuration illustrated in FIG. 17),the GANC sets the GANC IP Address to the CN IP Address and the GANC TEIDto the CN TEID; otherwise, the GANC assigns a local address as the GANCIP address and a GANC-allocated TEID as the GANC TEID and sends thisinformation to the UE (i.e., the configuration illustrated in FIG. 18).The UE 5105 acknowledges (in Step 5) the PTC activation.

The GANC 5110 sends (in Step 6) the RAB Assignment Response message tothe SGSN 5115 to complete the RAB Assignment procedure. If the GANC isconfigured to allow the SGSN 5115 to send GTP-U messages directly to theUE 5105 (i.e., the configuration illustrated in FIG. 17), the GANC 5110sets the RAN IP Address to the UE's IP Address and the RAN TEID to theTEID assigned to the UE by the GANC; otherwise, the GANC assigns a localaddress as the RAN IP address and a GANC-allocated TEID as the RAN TEIDand sends this information to the SGSN (i.e., the configurationillustrated in FIG. 18).

Next, the GANC 5110 signals (in Step 7) the completion of the RABestablishment to the UE 5105 with the GA-PSR ACTIVATE PTC COMPLETEmessage. On receipt of the message, the UE transitions to the PTC-ACTIVEsubstate and starts the PTC Timer. Next, additional PS signalingprocedures are performed (in Step 8). Examples of these PS signaling areillustrated in PDP Context Activation and Network Requested PDP ContextActivation sub-sections, below. The UE 5105 initiates (in Step 9) uplinkuser data transfer via the established PTC and the SGSN 5115 may use thesame transport channel to send downlink user data packets.

3. PTC Data Transfer

FIG. 52 illustrates the transfer of GPRS user data packets via the GANPacket Transport Channel. This scenario assumes that user data iscarried transparently between the UE and core network (i.e., theconfiguration illustrated in FIG. 17). As shown, the following steps areperformed.

When required, the GAN PTC is established (in Step 1) as specified inPCT Initial Activation sub-section, above. Upon the GA-PSR PTCestablishment, the UE 5205 enters the PTC-ACTIVE substate and starts thePTC Timer. Next, the UE 5205 initiates (in Step 2) the transfer of anuplink user data packet using the standard GTP-U protocol as specifiedin “GPRS Tunnelling Protocol (GTP) across the Gn and Gp interface”, 3GPPTS 29.060 standard, hereinafter “3GPP TS 29.060” and restarts the PTCTimer.

Next, the SGSN 5215 transfers (in Step 3) downlink user data packetutilizing the same PTC associated with the specific PDP context.Downlink user data packets are transferred using the standard GTP-Uprotocol as specified in 3GPP TS 29.060. Upon receiving the downlinkdata packet, the UE restarts the associated PTC Timer. Additional uplinkand downlink user data packets are transferred (in Step 4) via the samePTC as described in steps 2 and 3, respectively. After eachtransmission/reception, the UE restarts the PTC Timer. If theconfiguration illustrated in FIG. 18 is used, then the uplink GTP-Upackets are sent from UE to GANC, then relayed from GANC to SGSN;likewise, downlink GTP-U packets are sent from SGSN to GANC, thenrelayed from GANC to UE.

4. MS initiated PTC Deactivation

FIG. 53 depicts the scenario when the UE deactivates the PacketTransport Channel after the PTC Timer expires. The UE is in theGA-PSR-CONNECTED state and the PTC-ACTIVE substate. As shown, thefollowing steps are performed.

The PTC Timer associated with one of the active packet transportchannels expires (in Step 1). The UE 5305 sends (in Step 2) the GA-PSRDEACTIVATE PTC REQUEST message to the GANC 5310, including the RAB-ID toidentify the PTC and indicating the normal release as a cause fordeactivation. Alternatively, the UE may indicate PTC timer expiry as thecause for deactivation.

Next, the GANC 5310 sends (in Step 3) a RAB Release Request message tothe SGSN 5315 to request the release of the associated RAB. The SGSN5315 responds (in Step 4) with the RAB Assignment Request indicatingrelease.

The GANC 5310 responds (in Step 5) to the UE 5305 with a GA-PSRDEACTIVATE PTC ACK message to acknowledge successful deactivation. TheUE 5305 transitions to the PTC-STANDBY substate. The GANC 5310 sends (inStep 6) the RAB Assignment Response message to notify the SGSN 5315 thatthe RAB Release procedure is complete.

5. MS Initiated PTC Re-Activation

FIG. 54 depicts the scenario when in some embodiments the UE initiatesre-activation of the Packet Transport Channel while in theGA-PSR-CONNECTED and PMM-CONNECTED states; e.g., a PS signalingconnection and active PDP context exists between the UE and CN but thePTC was previously deactivated by the UE due to PTC Timer expiry. Asshown, the following steps are performed. The UE is in theGA-PSR-CONNECTED state and the PTC-STANDBY substate. The UE is in thePMM-CONNECTED state (i.e., a PS signaling connection and an active PDPcontext exists).

When the UE 5405 has a PDU to send, the UE 5405 sends (in Step 1) theService Request message (with Service type value “Data”) to the GANC5410 in the GA-PSR UL DIRECT TRANSFER message. Next, the GANC 5410forwards (in Step 2) the Service Request over the existing signalingconnection to the SGSN 5415 using the RANAP Direct Transfer message.

The SGSN 5415 may optionally initiate (in Step 3) the Security ModeControl procedure described in Security Mode Control sub-section, above.The SGSN 5415 sends (in Step 4) a Service Accept message to the GANC5410. The GANC 5410 forwards (in Step 5) the message to the UE.

Next, the UE 5405, GANC 5410 and SGSN 5415 establish (in Step 6) theGA-PSR Packet Transport Channel (PTC) as described in steps 3-7 in PTCInitial Activation Sub-section, above. The UE transitions to thePTC-ACTIVE substate and starts the PTC Timer. Finally, the UE 5405 sends(in Step 7) the uplink PDU. Additional data transfer may also takeplace.

6. Network Initiated PTC De-Activation

FIG. 55 depicts the scenario when the network initiates de-activation ofthe Packet Transport Channel in some embodiments. The UE is in theGA-PSR-CONNECTED state and the PTC-ACTIVE substate. As shown, thefollowing steps are performed.

Optionally, the GANC 5510 may initiate the PTC de-activation procedure;e.g., as a result of an error handling procedure. If so, the GANC 5510sends (in Step 1) the RAB Release Request message to the SGSN 5515.

The SGSN 5515 sends (in Step 2) a RAB Assignment Request to request therelease of the associated RAB. The release request may include one ormore RABs. Next, the GANC 5510 requests deactivation of the associatedGA-PSR PTC by sending (in Step 3) the GA-PSR DEACTIVATE PTC REQUESTmessage to the UE 5505.

The UE 5505 transitions to the PTC-STANDBY substate, stops the PTC Timerand sends (in Step 4) the acknowledgment back to the GANC. Steps 3 and 4are repeated for each additional RAB/PTC that needs to be released.Finally, the GANC 5510 notifies (in Step 5) the SGSN 5515 that therelease was successful.

7. Network Initiated PTC Re-Activation

FIG. 56 depicts the scenario in some embodiments when the networkinitiates re-activation of the Packet Transport Channel while the UE isin the GA-PSR-CONNECTED and PMM-CONNECTED states; e.g., a PS signalingconnection and active PDP context exists between the UE and CN but thePTC was previously deactivated. The UE is in the GA-PSR-CONNECTED stateand the PTC-STANDBY substate. The UE is in the PMM-CONNECTED state(i.e., a PS signaling connection and an active PDP context exists). Asshown, the following steps are performed.

When the SGSN 5615 has a PDU to send to the UE 5605, the SGSN 5615 mayoptionally initiate (in Step 1) the Security Mode Control proceduredescribed in Security Mode Control sub-section, above. The UE 5605, GANC5610 and SGSN 5615 establish (in Step 2) the GA-PSR Packet TransportChannel (PTC) as described in steps 3-7 in PTC Initial Activationsub-section, above. The UE transitions to the PTC-ACTIVE substate andstarts the PTC Timer. The SGSN 5615 then sends (in Step 3) the downlinkPDU. Additional data transfer may also take place.

8. Implicit PTC De-Activation Due to UE De-Registration

As part of the GAN de-registration procedure, the GANC needs to releaseall resources allocated to the UE. GAN de-registration may be initiatedeither explicitly by the UE or implicitly by the GANC if the loss of thesignaling connection is detected (as described in De-Registrationsub-section, above). FIG. 57 illustrates implicit PTC deactivationprocedure in some embodiments. Initially, one or more GA-PSR PTCsassociated with a UE are in the PTC-ACTIVE state. As shown, thefollowing steps are performed.

The GAN de-registration procedure is initiated (in Step 1) for the UE5705 either by the UE 5705 or GANC 5710. Optionally, any outstandingresources associated with the CS Domain are released (in Step 2).

The GANC 5710 initiates (in Step 3) the Iu release procedure to releasethe corresponding RABs. The SGSN 5715 responds (in Step 4) with IuRelease Command.

Upon receiving the Iu Release Command, the GANC 5710 locally deactivates(in Step 6) all associated PTCs and responds (in Step 6) to the SGSN5715 with an Iu Release Complete message.

R. PDP Context Activation

FIG. 58 illustrates the successful UE-initiated PDP Context Activationprocedure in some embodiments, assuming the UE is in GA-PSR-IDLE state.As shown, the following steps are performed.

The GA-PSR Connection Establishment procedure is performed (in Step 1)as described in GA-PSR Connection Establishment Sub-section, above. TheGANC 5810 establishes an SCCP connection to the SGSN and forwards (inStep 2) the Service Request message (with Service type value“Signaling”) to the SGSN 5815 using the RANAP Initial UE Message.Subsequent NAS messages between the UE and core network will be sentbetween GANC and SGSN using the RANAP Direct Transfer message.

The SGSN 5815 may optionally authenticate (in Step 3) the UE usingstandard UTRAN authentication procedures. The SGSN 5815 may optionallyinitiate (in Step 4) the Security Mode Control procedure described inSecurity Mode Control Sub-section, above. The SGSN 5815 responds (inStep 5) with a Service Accept message. The GANC 5810 forwards (in Step5) the message to the UE 5805.

The UE 5805 then sends (in Step 6) the Activate PDP Context Requestmessage providing details on the PDP context to the SGSN 5815. Thismessage is contained within the GA-PSR UL DIRECT TRANSFER between the UE5805 and the GANC 5810. The GANC 5810 forwards (in Step 6) the ActivatePDP Context Request message to the SGSN 5815.

Next, the UE 5805, GANC 5810, and SGSN 5815 establish (in Step 7) theGA-PSR Packet Transport Channel (PTC) as described in steps 3-7 in PTCInitial Activation, above. The SGSN 5815 indicates (in Step 8) the PDPcontext establishment is complete using the Activate PDP Context Acceptmessage to the GANC. GANC forwards this message to the UE in the GA-PSRDL DIRECT TRANSFER message. Finally, the UE 5805 and CN 5815 exchange(in Step 9) user data transfer via the established PTC.

S. Network Requested PDP Context Activation

FIG. 59 illustrates the successful Network-Requested PDP ContextActivation procedure in some embodiments, assuming the UE is inGA-PSR-IDLE state. Initially, the SGSN received downlink user data totransfer to the UE and the associated RAB is not established. The UE isin PMM-IDLE state. As shown, the SGSN 5915 sends (in Step 1) the RANAPPaging message to the UE 5905 via the GANC 5910 to locate the user. Thepaging request indicates paging for PS Domain signaling.

The GANC 5910 forwards (in Step 2) the paging information to the UE 5905in the GA-PSR PAGING REQUEST message. The GA-PSR ConnectionEstablishment procedure is performed (in Step 3) as described in GA-PSRConnection Establishment Sub-section, above. Alternatively, rather thanusing the GA-PSR Connection Establishment procedure, the UE 5905 maysend the GA-PSR PAGING RESPONSE message (in Step 3) and then transitionto the GA-PSR CONNECTED state.

The GANC 5910 establishes an SCCP connection to the SGSN and forwards(in Step 4) the Service Request message (with Service type value “Pagingresponse”) to the SGSN 5915 using the RANAP Initial UE Message.Subsequent NAS messages between the UE 5905 and core network 5915 willbe sent between GANC 5910 and SGSN 5915 using the RANAP Direct Transfermessage.

The SGSN 5915 may optionally authenticate (in Step 5) the UE 5905 usingstandard UTRAN authentication procedures. The SGSN 5915 may optionallyinitiate (in Step 6) the Security Mode Control procedure described inSecurity Mode Control Sub-section, above.

Next, the SGSN 5915 sends (in Step 7) the Request PDP Context Activationmessage to the GANC 5910. The GANC 5910 forwards (in Step 7) thismessage to the UE 5905 in the GA-PSR DL DIRECT TRANSFER message. The UE5905 sends (in Step 8) the Activate PDP Context Request messageproviding details on the PDP context to the SGSN 5915. This message iscontained within the GA-PSR UL DIRECT TRANSFER between the UE and theGANC. The GANC 5910 forwards (in Step 8) the Activate PDP ContextRequest message to the SGSN 5915.

The UE 5905, GANC 5910, and SGSN 5915 establish (in Step 9) the GA-PSRPacket Transport Channel (PTC) as described in steps 3-7 in PTC InitialActivation Sub-section, above. The SGSN 5915 indicates (in Step 10) thePDP context establishment is complete using the Activate PDP ContextAccept message to the GANC. GANC forwards this message to the UE in theGA-PSR DL DIRECT TRANSFER message. Finally, the UE 5905 and SGSN 5915exchange (in Step 11) user data transfer via the established PTC.

T. SRNS Relocation between UTRAN and GAN

The SRNS Relocation procedure is performed to move one or more PSsessions between Iu mode GAN and UTRAN. It relocates the Iu-psconnection point at the GAN/UTRAN (in all cases) and at the SGSN (forinter-SGSN Relocation case only).

Support for the Iur interface between UTRAN and GAN is not described inthis document. Therefore, only the Combined Hard Handover and SRNSRelocation is applicable for GAN-UTRAN SRNS Relocation. Consequently,only the “UE Involved” Relocation Type is supported.

1. SRNS Relocation from UTRAN to GAN

a) Preparation Phase

FIG. 60 illustrates the UTRAN to GAN SRNS relocation preparation phasein some embodiments. As shown, the following steps are performed.

The UE 6005 has one or more active PDP Contexts with active RABs in theUTRAN. Next, the UE 6005 detects a GAN 6015, performs (in Step 2) theRegistration procedures and enters GA-RC-REGISTERED state with valid GANcell identity information.

The Measurement Control message (in Step 3) from the RNC 6010 to UE 6005includes this GAN's cell identity. The UE begins to include the GAN cellinformation in the Measurement Report sent (in Step 3 a) to the RNC. Inthat message, it sets the GAN cell's signal strength indicator to thehighest possible value.

Next, the RNC 6010 decides to initiate a Combined Hard Handover and SRNSRelocation procedure. This decision is made based on the measurementreports and vendor/operator specific criteria. Upon deciding to initiatethe Relocation, the RNC 6010 sends (in Step 4) Relocation Required tothe SGSN.

The SGSN 6020 determines the target cell is the GANC, based on thecontents of Relocation Required. The SGSN 6020 then sends (in Step 5)the Relocation Request to the GANC 6015.

Upon receiving Relocation Request message, the GANC 6015 will setup (inStep 6) Packet Transport Channel(s) as described in steps 4, 5 and 7 inPTC Initial Activation Sub-section, above as needed with appropriateattributes, as defined in the message. The GANC 6015 will then send (inStep 6 a) a Relocation Request Acknowledge to the SGSN.

b) Execution Phase

FIG. 61 illustrates UTRAN to GAN SRNS Relocation Execution Phase in someembodiments. As shown, the following steps are performed.

Upon receiving the positive acknowledgement from the GANC 6115 to servethe UE 6105, the SGSN 6120 initiates the Execution Phase by sending (inStep 1) the Relocation Command to the RNC 6110. The RNC 6110 instructsthe UE 6105 by sending (in Step 2 a) the Physical ChannelReconfiguration message to initiate the physical layer switch to move tothe GAN.

When the QoS attributes of any of the active RABs require losslessin-sequence SDU Delivery (lossless PDCP), then the RNC 6110 startsforwarding (in Step 2 b) GTP PDUs to the GANC 6115 while stilltransmitting them in the downlink direction to the UE 6105. Thisforwarding is routed via the Iu_PS interface. The GANC may buffer,transmit in the downlink, or discard these forwarded GTP PDUs, dependingon the QoS profile, network conditions, and whether it supports LosslessRelocation. Specific implementation is vendor and/or operator specific.In addition, the GANC may delay the start of the downlink transmissionuntil Step 5 below to synchronize the GTP-U sequence numbers.

The RNC sends (in Steps 2 c and 3 a) the Forward SRNS Context message tothe GAN via the SGSN. In this message, the next-expected sequence numberof uplink and downlink GTP-U packets are indicated to the GANC by theold SRNC. If the QoS attributes require and GANC supports LosslessRelocation, then these sequence numbers are used to ensure in-sequencedelivery of GTP PDUs.

Immediately after receiving the Physical Channel Reconfigurationmessage, the UE 6105 sends (in Step 3 b) GA-PSR-HANDOVER-COMPLETEmessage to the GANC 6115. Upon receiving this message and the ForwardSRNS Context message sent from the SGSN 6120 (in Step 3 a), the GANC6115 becomes the Serving RNC.

Immediately upon receiving the GA-PSR-HANDOVER-COMPLETE message from theUE, the GANC 6115 sends (in Step 4) the Relocation Detect message to theSGSN 6120. When the UE supports Lossless Relocation and one or more RABsQoS attribute requires it, the UE initiates (in Step 5) a GTP-U sequencenumber exchange procedure with the GANC over the newly established PTC.When the GANC 6115 supports Lossless Relocation and one or more RABs QoSattribute requires it, it may also initiate a GTP-U sequence numberexchange procedure, if the procedure had not been already initiated bythe UE.

Upon completion of the GTP-U sequence number exchange procedure, theGANC 6115 sends (in Step 6) Relocation Complete message to the SGSN. Ifthe GTP-U sequence number exchange is skipped (either due to lack ofsupport in UE and/or GAN or QoS attributes did not require it), then theRelocation Complete is sent right after the Relocation Detect message.The active RABs and PDP contexts are now moved to between UE, GANC andSGSN. The SGSN 6120 then releases (in Step 7) the Iu_PS connection withthe old RNC 6110. When the Routing Area of the GANC cell (as indicatedby the GANC to the UE) is different from that under the old RNC, thenthe UE 6105 performs (in step 8) Routing Area Update procedure.

2. SRNS Relocation from GAN to UTRAN

a) Preparation Phase

FIG. 62 illustrates GAN to UTRAN SRNS Relocation Preparation Phase insome embodiments. As shown, the followings steps are performed.

The UE 6205 is (in Step 1) in active packet flow exchange with activePDP Context(s) and PTCs in the GAN. The GANC 6215 may send (in Step 2) aGA-PSR UPLINK QUALITY INDICATION if there is a problem with the uplinkquality for the ongoing session. Uplink Quality Indication isinformation sent by the GANC 6215 to the UE 6205 indicating the crossingof an uplink quality threshold in the uplink direction. Whenever the UEreceives an indication of bad quality, it should start the relocationprocedure, as described in the next step. Alternatively, UE can use itslocal measurements to decide to initiate the handover procedure.

Next, the UE decides to initiate an SRNS Relocation from GAN to UTRAN bysending (in Step 3) GA-PSR-HANDOVER-INFORMATION message to the GANC6215. Specific criteria for this decision would include the case of theUE leaving GAN coverage (e.g., based on deteriorating WLAN signalquality).

The GANC 6215 selects a target RNC based on the contents of theGA-PSR-HANDOVER-INFORMATION message (e.g., the RNC serving the cellidentified by the UE as having the best signal quality). The GANC 6215sends (in Step 4) Relocation Required message to the SGSN 6220containing the selected RNC information.

The SGSN 6220 sends (in Step 5) a Relocation Request to the target RNC6210. The RNC 6210 performs (in Step 6) the necessary allocation ofradio and Iu transport resources and returns (in Step 7) RelocationRequest Acknowledge message to the SGSN. This message containschannelization information needed by UE to access UTRAN.

b) Execution Phase

FIG. 63 illustrates GAN to UTRAN SRNS Relocation Execution Phase in someembodiments. As shown, the followings steps are performed.

The SGSN 6320 begins the Execution Phase by issuing (in Step 1)Relocation Command to the GANC 6315. The message contains the channelaccess information in the target UTRAN cell. The GANC 6315 sends (inStep 2 a) GA-PSR-HANDOVER-COMMAND to the UE 6305. This message containsthe information from the Relocation Command received in Step 1 earlier.The GANC may suspend downlink GTP PDU transfer at this point. If GANCsupports Lossless SRNS Relocation and any of existing RABs' QoS requiresit, the GANC may initiate (in Step 2 c) forwarding of GTP PDUs to thetarget RNC 6310 via the SGSN 6320.

The GANC 6315 also sends (in Steps 2 b and 3) Forward SRNS Context tothe target RNC via the SGSN. As shown, the GANC sends the Forward SRNSContext message (in Step 2 b) to the SGSN and the SGSN relays (in Step3) the Forward SRNS Context to the target RNC.

Upon receiving the GA-PSR-HANDOVER-COMMAND, the UE immediately suspendsuplink GTP PDU transfer. It immediately begins accessing the UTRAN usingindicated channel access parameters in the message. UE's access attemptis detected by the Node B and RNC 6310, and is reported (in Step 4) tothe SGSN 6320 via the Relocation Detect message.

The UE completes the lower layer setup and configuration, and sends (inStep 5 a) the RRC Physical Channel Reconfiguration Complete to thetarget RNC 6310. This triggers the RNC 6310 to send (in Step 5 b) theRelocation Complete message to SGSN 6320. At this stage, the target RNCassumes the role of SRNC for the UE.

The packet data flow is now (in Step 6) active via the UTRAN. Next, theSGSN releases the Iu_PS connection by sending (in Step 7 a) Iu ReleaseCommand message to the GANC, to which GANC responds (in Step 7 b) withIu Release Complete message. If the Routing Area of the cell under thetarget RNC is different from that under the old GANC cell, then the UE6305 performs (in Step 8) the Routing Area Update procedure.

U. Short Message Service

GAN provides support for both Circuit Switched and Packet Switched SMSservices. GAN-attached UEs will be able to send and receive SMS messagesvia the GAN.

1. CS-Based SMS

CS-based SMS support in GAN is based on the same mechanism that isutilized for CS mobility management and call control. On the UE side,the SMS layers (including the supporting CM sub layer functions) utilizethe services of the MM layer to transfer SMS messages per standardcircuit switched UMTS implementation.

The SM-CP protocol is effectively tunneled between the UE and the CN,using GA-CSR UPLINK DIRECT TRANSFER and GA-CSR DOWNLINK DIRECT TRANSFERmessages between the UE and the GANC, where the GANC relays the SM-CPmessages via RANAP messages for transport over the Iu-cs interface. Aswith the mobility management and call control procedures, the secureIPSec tunnel and TCP session are used to provide secure and reliable SMSdelivery over the IP network.

2. PS-Based SMS

PS-based SMS message transfer is based on the same mechanism as thetransfer of the PS mobility management and session management signalingmessages. On the UE side, the SMS layers (including the supporting CMsub layer functions) utilize the services of the GA-PSR layer totransfer SMS messages per standard packet switched UMTS implementation.As with mobility management and session management signaling, the secureIPSec tunnel and TCP session is used to provide secure and reliablePS-based SMS delivery over the IP network.

VI. CONFIGURATION INFORMATION

A. GAN UARFCN and Primary Scrambling Code for Handover-to-GAN

In some embodiments, selection of the UMTS Absolute Radio FrequencyChannel Number (UARFCN) use the following guidelines:

-   -   1. The UARFCN should be allocated from the operator's assigned        UARFCN values.    -   2. The UARFCN may be desired to be the same unique number across        the whole operator network to minimize the RNC configuration        effort.    -   3. The Primary Scrambling Code (possible values from 0 to 511)        should not be allocated from the operator's in-use values; i.e.,        codes used by macro cells.    -   4. The Primary Scrambling Code may be desired to be the same        unique number across the whole operator network to minimize the        RNC configuration effort.

Several options are discussed in more detail below.

1. Option 1

Some embodiments allocate the GAN UARFCN from the DCS band that is beingused for GSM. This would result in the DL UARFCNs in the range of 1162to 1513, inclusive. In this scheme, there are no restrictions in theselection of the specific primary scrambling code (PSC) for GAN—any ofthe 512 values can be used in the particular UARFCN chosen.

Where initial UMTS deployments are in the 1900 MHz band, an analogousapproach may be employed—namely the use of UARFCNs from the 850 MHzband. That would give a GAN UARFCN range of 4357 to 4458, inclusive.Alternatively, UARFCNs from a PCS sub-band doing a non-UMTS technologycan also be specified. Again, there are no restrictions in the selectionof PSC in a given GAN UARFCN.

2. Option 2

The strategy here is to take advantage of TDD unpaired spectrum and useits UARFCN ranges for GAN purposes. Many operators, as part of the UMTSauction, won a TDD unpaired 5 MHz spectrum, in addition to one or moreFDD pairs. The TDD spectrum has remained unused and is likely to remainthat way for near foreseeable future.

Even if a given operator does not own any TDD spectrum in a givenmarket, any unused TDD spectrum from any operator in the market can beused since it is a completely harmless interference-free procedure for aUE to do a cell search. Even if a given TDD unpaired 5 MHz is in use inUTRAN-TDD mode, an FDD-only handset is likely fail beyond the initialsynchronization at PHY layer. Many handsets planned for near foreseeablefuture are FDD-only.

If the handsets semantically allow these values, and these UARFCNs areindeed defined in 3GPP, and the infrastructure vendors do allowprovisioning of these UARFCN ranges in their systems, then this approachis feasible. The UARFCN ranges in this case are: 9504 to 9596 and 10054to 10121. As is the case in Option 1, there are no restrictions in PSCselection of GAN.

3. Option 3

This plan calls for use of idle FDD spectrum's UARFCN for GAN purpose.The “idle” spectrum may or may not belong the particular operator. Inmany parts of Europe and Asia, the FDD spectrums are still unused due tobidders of auction either going out of business or the owners choosingnot to deploy services yet due to cost and unavailability of equipment.

VII. IDENTIFIERS IN GAN

A. Identifiers for UEs and Generic IP Access Network

The key UE and generic IP access network addressing parameters are theIMSI associated with the (U)SIM in the terminal, Public IP Address ofthe UE, and the generic IP access network point of attachment address(AP-ID). The IMSI associated with the (U)SIM is provided by the UE tothe GANC during the Registration procedure. The GANC maintains a recordfor each registered UE. For example, IMSI is used by the GANC to indexthe appropriate UE record when the GANC receives a RANAP PAGING message.

The Public IP address of UE is the source IP present in the outermost IPheader of packets received from the UE by the GANC-SEGW. If available,this identifier may be used by the GANC to support location services andfraud detection or by service providers to signal Managed IP networks IPflows that require special QoS treatment.

The generic IP access network point of attachment address (AP-ID) isprovided by the UE to the GANC at Registration. The AP-ID may be used bythe GANC to support location services or by the service provider torestrict GAN access to authorized APs.

B. Service Area Identifiers for GAN

1. GAN Service Area for Location Services & Billing

Service Area Identifiers (SAI) in UMTS may be used to performlocation-basing routing of a call for services such as: emergencyservices; operators; announcements and freephone numbers. SAI can bealso used by the core network to identify the location of where a callwas originated/terminated for charging purposes. The GANC provides a SAIto the core network indicating the Iu-mode GAN service area.

a) Assigning GAN SAI Based on UTRAN/GERAN Location

In the Iu-mode GAN architecture, the UE has a direct IP-based connectionto the GANC. The GAN coverage area may overlay the UTRAN/GERAN coveragearea. Logical mapping of GAN Cells to a SAI can be completed at variousresolutions, for example (but not limited to): (1) a GAN SAI for eachUTRAN/GERAN cell, (2) a GAN SAI for each UTRAN/GERAN routing area; or(3) a GAN SAI for each UTRAN/GERAN location area. A single GANC couldrepresent one or more SAI in one or more location areas (LAI).

VIII. ALTERNATIVE EMBODIMENTS

In some embodiments, instead of using separate CSR and PSR protocols, asdescribed in the previous sections, a single protocol, Generic AccessRadio Resource Control (GA-RRC) is used. The following sections describethe architecture and messaging features of this protocol layer. Only thefeatures that are different from the previous embodiments are described.

A. Control and User Plane Architecture

The Iu interface standards include support for both ATM and IP-basedsignaling and user data transport mechanisms.

1. Circuit Switched (CS) Domain

a) CS Domain—Control Plane

FIG. 64 illustrates the GAN architecture in support of the CS Domaincontrol plane in some embodiments. The figure shows different protocollayers for the UE 6405, Generic IP Network 6410, GANC 6415, and MSC6420. FIG. 64 also shows the two interfaces Up 6425 and Iu-cs 6430. Themain features of the GAN CS domain control plane architecture are asfollows. The underlying Access Layers 6435 and Transport IP layer 6440provide the generic connectivity between the UE 6405 and the GANC 6415.The IPSec layer 6445 provides encryption and data integrity between theUE 6405 and GANC 6415. The Remote IP layer 6450 is the ‘inner’ IP layerfor IPSec tunnel mode and is used by the UE 6405 to be addressed by theGANC 6415. The Remote IP layer 6450 is configured during the IPSecconnection establishment.

In some embodiments a single TCP connection 6455 is used to providereliable transport for both the GA-RC 6460 and GA-RRC 6465 signalingbetween the UE 6405 and GANC 6415. The TCP connection 6455 is managed byGA-RC 6460 and is transported using the Remote IP layer 6450.

The Generic Access Resource Control (GA-RC) protocol 6460 manages the Upsession, including the GAN discovery and registration procedures. TheGeneric Access Radio Resource Control (GA-RRC) protocol 6465 performsfunctionality equivalent to the UMTS-RRC protocol, using the underlyingconnection managed by the GA-RC sublayer 6460. Note that GA-RRC 6465includes both CS service and PS service-related signaling messages. TheGANC 6415 terminates the GA-RRC protocol 6465 and inter-works it to theRANAP protocol 6470 over the Iu-cs 6430 interface. The NAS protocols,such as MM 6475 and above, are carried transparently between the UE 6405and MSC 6420. In some embodiments, the Iu-cs signaling transport layers6495 are per 3GPP TS 25.412.

b) CS Domain—User Plane

FIG. 65 illustrates the GAN protocol architecture in support of the CSdomain user plane in some embodiments. The figure shows differentprotocol layers for the UE 6505, Generic IP Network 6510, GANC 6515, andMSC 6520. FIG. 65 also shows the two interfaces Up 6525 and Iu-cs 6530.The main features of the GAN CS domain user plane architecture are asfollows. The underlying Access Layers 6535 and Transport IP layer 6540provide the generic connectivity between the UE 6505 and the GANC 6515.

The IPSec layer 6545 provides encryption and data integrity. CS domainuser plane data is transported using the Iu User Plane (Iu UP) protocol6550 running over RTP/UDP (6555 and 6560) between UE 6505 and MSC 6520.Each Iu UP protocol 6550 instance may operate in either transparent orsupport modes, as described in “UTRAN Iu interface user planeprotocols”, 3GPP TS 25.415 standard. The mode choice is indicated to theGANC by the MSC using RANAP and to the UE by the GANC using GA-RRC.Support for the AMR FR codec, as specified in “AMR speech codec; Generaldescription”, 3GPP TS 26.071 standard, is mandatory when operating inGAN mode, with support for other codecs being optional. In someembodiments, the Iu-cs data transport layers 6595 are per 3GPP TS25.414.

Some embodiments that utilize GA-RRC protocol implement a protocol stackfor the GANC that is different than the protocol stack shown for theGANC 6515. In these embodiments, the GANC protocol stack is similar tothe GANC 1115 protocol stack illustrated in FIG. 11. In theseembodiments, the GANC has additional protocol layers Remote IP, UDP, andRTP over the IPSec layer 6545. The GANC also has the additional Iu UPprotocol layer over the data transport layers 6595. Similar to the GANC1115 shown in FIG. 11, the GANC in these embodiments interworks the CSdomain user plane between the RTP/UDP and the Iu User Plane protocol.

2. Packet Switched (PS) Domain

a) PS Domain—Control Plane

FIG. 66 illustrates the GAN architecture in support of the PS DomainControl Plane in some embodiments. The figure shows different protocollayers for the UE 6605, Generic IP Network 6610, GANC 6615, and SGSN6620. FIG. 66 also shows the two interfaces Up 6625 and Iu-ps 6630. Themain features of the GAN PS domain control plane architecture are asfollows. The functions of GA-RRC 6635 and underlying layers are asdescribed in Sub-section VIII.A.1.a: “CS Domain—Control Plane”, above.The GA-RRC protocol 6635 performs functionality equivalent to the UTRANRRC protocol, using the underlying Up session managed by the GA-RC 6640.The GA-RRC 6635 includes both CS service and PS service-relatedsignaling messages.

The GANC 6615 terminates the GA-RRC protocol 6635 and inter-works it tothe RANAP protocol 6645 over the Iu-ps interface 6630. NAS protocols,such as for GMM, SM and SMS 6650, are carried transparently between theUE 6605 and SGSN 6620. In some embodiments, the Iu-ps signalingtransport layers 6695 are per 3GPP TS 25.412.

b) PS Domain—User Plane

FIG. 67 illustrates the GAN architecture for the PS Domain User Plane insome embodiments. The figure shows different protocol layers for the UE6705, Generic IP Network 6710, GANC 6715, and SGSN 6720. FIG. 67 alsoshows the two interfaces Up 6725 and Iu-ps 6730. The main features ofthe GAN PS domain user plane architecture are as follows. The underlyingAccess Layers 6735 and Transport IP 6740 layer provides the genericconnectivity between the UE 6705 and the GANC 6715. The IPSec layer 6745provides encryption and data integrity. The GTP-U 6750 protocol operatesbetween the UE 6705 and the SGSN 6720, transporting the upper layerpayload (i.e., PS domain user plane data 6755) across the Up 6725 andIu-ps interfaces 6730. User data is carried transparently between the UE6705 and core network. In some embodiments, the Iu-ps data transportlower layers 6795 are per 3GPP TS 25.414.

Some embodiments that utilize GA-RRC protocol implement a protocol stackfor the GANC that is different than the protocol stack shown for theGANC 6715. In these embodiments, the GANC protocol stack is similar tothe GANC 1815 protocol stack illustrated in FIG. 18. In theseembodiments, the GANC has additional protocol layers Remote IP, UDP, andGTP-U over the IPSec layer 6745. In these embodiments, the GTP-U in theUE and the GTP-U layer over the UDP layer in the GANC is a part ofGA-RRC protocol. The GANC also has the additional IP, UDP, and GTP-Ulayers over the data transport lower layers 6795.

3. GA-RC (Generic Access Resource Control)

The GA-RC protocol provides a resource management layer, with thefollowing functions. Discovery and registration with GANC, registrationupdate with GANC, application level keep-alive with GANC, and supportfor identification of the AP being used for GAN access.

b) States of the GA-RC Sub-Layer

FIG. 68 illustrates the GA-RC sublayer in the UE in some embodiments. Asshown, the GA-RC sub-layer in the UE can be in one of two states:GA-RC-DEREGISTERED 6805 or GA-RC-REGISTERED 6810. In theGA-RC-DEREGISTERED state 6805, the UE may be in a GAN coverage area;however, the UE has not registered successfully with the GANC. The UEmay initiate the GAN Registration procedure when in theGA-RC-DEREGISTERED state 6805. The UE returns to GA-RC-DEREGISTEREDstate 6805 on loss of TCP or IPSec connection or on execution of the GANDe-registration procedure.

In the GA-RC-REGISTERED state 6810, the UE is registered with theServing GANC. The UE has an IPSec tunnel and an TCP connectionestablished to the Serving GANC through which the UE may exchange GA-RCor GA-RRC signaling messages with the GANC. While the UE remains in theGA-RC-REGISTERED state 6805 it performs application level keep-alivewith the GANC.

In the GA-RC-REGISTERED state, the UE may be in either UTRAN/GERAN mode6815 or GAN mode 6820. The UE (1) may be camped on GERAN or UTRAN andidle, (2) may be active in GERAN or UTRAN (e.g., a GSM RR or a UTRAN RRCconnection may be established), (3) may have “roved in” to GAN mode, or(4) may have recently “roved out” of GAN mode (e.g., due to handoverfrom GAN).

4. GA-RRC (Generic Access Radio Resource Control)

The GA-RRC protocol provides a resource management layer, which is areplacement for UTRAN-RRC and provides the following functions: (1)setup of transport channels for CS and PS traffic between the UE andGANC, (2) flow control of PS traffic, (3) CS and PS handover supportbetween UTRAN/GERAN and GAN, (4) direct transfer of NAS messages betweenthe UE and the core network, and (5) other functions such as paging andsecurity configuration.

b) States of the GA-RRC Sub-Layer

The GA-RRC sub-layer in the UE can be in two states, GA-RRC-IDLE 6825 orGA-RRC-CONNECTED 6830 as illustrated in FIG. 68. The UE enters theGA-RRC-IDLE 6825 state when the UE switches the serving RR entity toGA-RRC and the SAP between the NAS and the GA-RRC is activated. Thisswitch may occur only when the GA-RC is in the GA-RC-REGISTERED state.The UE moves from the GA-RRC-IDLE state 6825 to the GA-RRC-CONNECTEDstate 6830 when the GA-RRC connection is established and returns toGA-RRC-IDLE state when the GA-RRC connection is released. Upon GA-RRCconnection release, an indication that no dedicated resources exist ispassed to the upper layers. The UE may also enter the GA-RRC-CONNECTEDstate while in the GA-RC-REGISTERED state in GERAN/UTRAN mode whenHandover to GAN is being performed. In the same way, the UE enters theGA-RC-REGISTERED state in GERAN/UTRAN mode from the GA-RRC-CONNECTEDstate when Handover from GAN is successfully executed.

B. High-Level Procedures

1. GA-RRC Connection Handling

The GA-RRC connection is a logical connection between the UE and theGANC, either for the CS or PS domain. It is established when the upperlayers in the UE request GA-RRC to establish a signaling connection andthe UE is in idle mode (no RRC connection exists). When a successfulresponse is received from the network, GA-RRC replies to the upper layerthat it has entered RRC connected mode. The upper layers have then thepossibility to request transmission of NAS messages to the network.

a) GA-RRC Connection Establishment

i) UE Initiated GA-RRC Connection Establishment

FIG. 69 illustrates successful (and unsuccessful) establishment of theGA-RRC Connection when initiated by the UE in some embodiments. The UE6905 initiates GA-RRC connection establishment by sending (in Step 1)the GA-RRC REQUEST message to the GANC 6910. This message contains theEstablishment Cause indicating the reason for GA-RRC connectionestablishment. The message also includes the Domain Indicator (CS orPS). GANC 6910 signals the successful response to the UE 6905 by sending(in Step 2) the GA-RRC REQUEST ACCEPT and the UE 6905 enters GA-RRCconnected mode. Alternatively, the GANC 6910 may return (in Step 3) aGA-RRC REQUEST REJECT indicating the reject cause.

ii) Network Initiated GA-RRC Connection Establishment

FIG. 70 illustrates successful establishment of the GA-RRC Connectionwhen initiated by the network in some embodiments. The CN 7015 sends (inStep 1) a RANAP Paging message to the GANC 7010 identified through thelast Location Update received by it and includes the TMSI if available.The IMSI of the UE being paged is always included in the request, as isthe Domain Indicator (CS or PS). A paging cause may be included.

Next, the GANC 7010 identifies the UE registration context using theIMSI provided by the CN 7015. It then pages (in Step 2) the UE 7005using the GA-RRC PAGING REQUEST message. The UE 7005 responds (in Step3) with a GA-RRC INITIAL DIRECT TRANSFER message containing a NASmessage appropriate to the Domain Indicator (CS or PS) and cause.Alternatively, the UE 7005 responds (in Step 3) with a GA-RRC PAGINGRESPONSE message containing a NAS message, the Domain Indicator (i.e.,CS or PS) and cause. The UE 7005 enters GA-RRC connected mode. The GANC7010 establishes an SCCP connection to the CN 70015. The GANC 7010 thenforwards (in Step 4) the NAS message to the CN 7015 using the RANAPInitial UE Message. Subsequent NAS messages between the UE and corenetwork will be sent between GANC and CN using the RANAP Direct Transfermessage.

b) GA-RRC Connection Release

FIG. 71 shows release of the logical GA-RRC connection between the UEand the GANC in some embodiments. The CN 7115 indicates (in Step 1) tothe GANC 7110 to release the user plane connection allocated to the UE7115, via the RANAP Iu Release Command message. The GANC 7110 confirms(in Step 2) resource release to CN 7115 using the Tu Release Completemessage 7125.

Next, the GANC 7110 commands (in Step 3) the UE 7105 to releaseresources, using the GA-RRC CONNECTION RELEASE message. The UE 7105confirms (in Step 4) resource release to the GANC 7110 using the GA-RRCCONNECTION RELEASE COMPLETE message and the GA-RRC state in the UEchanges to idle.

3. Security Mode Control

FIG. 72 illustrates the message flow for security mode control in someembodiments. The CN 7215 sends (in Step 1) the RANAP Security ModeCommand message to GANC 7210. This message contains the integrity key(IK) and allowed algorithms, and optionally the encryption key (CK) andallowed algorithms. The GANC 7210 sends (in Step 2) the GA-RRC SECURITYMODE COMMAND message to the UE 7205. This message indicates theintegrity protection and encryption settings (i.e., that are applicableafter relocation to UTRAN), and a random number. The UE 7205 stores theinformation for possible future use after a handover to UTRAN.

Next, the UE 7205 computes a MAC based on the random number, the UE IMSIand the integrity key calculated by the UE. The UE 7205 then sends (inStep 3) the GA-RRC SECURITY MODE COMPLETE message to signal its selectedalgorithm and the computed MAC. The GANC 7210 then verifies the MACusing the random number, the UE IMSI and the integrity key provided bythe CN 7215 in step 1. If the GANC verifies the MAC to be correct itsends (in Step 4) the Security Mode Complete message to the CN 7215. TheMAC proves that the identity that is authenticated to the GANC is thesame as the identity authenticated to the core network.

4. GA-RRC NAS Signaling Procedures

After GA-RRC connection establishment, NAS signaling may be transferredfrom CN-to-UE and from UE-to-CN.

a) CN-to-UE NAS Signalling

FIG. 73 illustrates core network to UE NAS signaling of someembodiments. For CN-to-UE NAS signaling, the Core Network 7315 sends (inStep 1) a NAS PDU to the GANC via the RANAP Direct Transfer message. TheGANC 7310 encapsulates (in Step 2) the NAS PDU within a GA-RRC DL DIRECTTRANSFER message and forwards the message to the UE 7305 via theexisting TCP connection.

b) UE-to-CN NAS Signaling

FIG. 74 illustrates the UE to core network NAS signaling of someembodiments. The UE 7405 GA-RRC layer receives a request from the NASlayer to transfer an uplink NAS PDU. Since the MM connection (and henceRR signaling connection) already exists, the UE GA-RRC encapsulates theNAS PDU within a GA-RRC UL DIRECT TRANSFER message and sends (in Step 1)the message to the GANC 7410. The GANC 7410 relays (in Step 2) thereceived message to the Core Network 7415 via the RANAP Direct Transfermessage 7420.

5. Mobile Originated CS Call

a) UE Terminate Iu UP Packet

FIG. 75 illustrates mobile originated CS call procedure in someembodiments. The description of the procedure assumes the UE 7505 is inGAN mode; i.e., it has successfully registered with the GANC 7510 andGA-RRC is the serving RR entity in the UE 7505. It also assumes that noGA-RRC connection exists between the UE 7505 and GANC 7510 (i.e.,GA-RRC-IDLE state). The GA-RRC Connection Establishment procedure isperformed (in Step 1) as described in Sub-section VIII.B.1.a.i: UEInitiated GA-RRC Connection Establishment, above. Upon request from theupper layers, the UE 7505 sends (in Step 2) the CM Service Request tothe GANC 7510 in the GA-RRC INITIAL DIRECT TRANSFER message.

The GANC 7510 establishes an SCCP connection to the CN 7515 and forwards(in Step 3) the CM Service Request to the CN 7515 using the RANAPInitial UE Message. Subsequent NAS messages between the UE 7505 and corenetwork 7515 will be sent between GANC 7510 and CN 7515 using the RANAPDirect Transfer message.

The CN 7515 may optionally authenticate (in Step 4) the UE 7505 usingstandard UTRAN authentication procedures. The CN 7515 may optionallyinitiate (in Step 5) the Security Mode Control procedure described inSub-section VIII.B.3: “Security Mode Control”, above.

The UE 7505 sends (in Step 6) the Setup message providing details on thecall to the CN 7515 and its bearer capability and supported codecs. Thismessage is contained within the GA-RRC UL DIRECT TRANSFER between the UE7505 and the GANC 7510. The GANC 7510 forwards (in Step 6) the Setupmessage to the CN 7515.

The CN 7515 indicates (in Step 7) it has received the call setup and itwill accept no additional call-establishment information using the CallProceeding message to the GANC 7510. The GANC 7510 forwards (in Step 7)this message to the UE 7505 in the GA-RRC DL DIRECT TRANSFER message.

The CN 7515 requests (in Step 8) the GANC 7510 to assign call resourcesusing the RANAP RAB Assignment Request message. The CN 7515 includes theRAB-ID, the CN Transport Layer Address (IP address) and the CN IuTransport Association (UDP port number) for user data. The GANC 7510sends (in Step 9) the GA-RRC ACTIVATE CHANNEL message to the UE 7505including bearer path setup information received in the RAB AssignmentRequest message such as: (1) Radio Access Bearer (RAB) parameters; e.g.,RAB-ID, UDP port & the IP address for the uplink RTP stream and (2) IuUP parameters (e.g., Iu UP mode, where support mode is used for AMRvoice calls).

Since Iu UP support mode is indicated, the UE 7505 sends (in Step 10)the Iu UP INITIALISATION packet to the IP address and UDP port indicatedin the GA-RRC ACTIVATE CHANNEL message. This message is routed to thecore network 7515 (e.g., the R4 media gateway). The core network 7515responds (in Step 11) with the Iu UP INITIALISATION ACK packet. The corenetwork 7515 sends the message to the source IP address and UDP portnumber of the received INITIALISATION packet.

The UE 7505 sends (in Step 12) the GA-RRC ACTIVATE CHANNEL ACK to theGANC 7510. The GANC signals (in Step 13) to the CN 7515 that the RAB hasbeen established by sending a RANAP RAB Assignment Response message. TheGANC 7510 signals (in Step 14) the completion of the RAB establishmentto the ULE 7505 with the GA-RRC ACTIVATE CHANNEL COMPLETE message.

An end-to-end audio path now exists between the UE 7505 and the CN 7515.The UE 7505 can now connect the user to the audio path. The CN 7515signals to the UE 7505, with the Alerting message, that the called partyis ringing. The message is transferred (in Step 15) to the GANC 7510 andGANC forwards (in Step 15) the message to the UE 7505 in the GA-RRC DLDIRECT TRANSFER.

When the UE 7505 has not connected the audio path to the user, itgenerates ring back to the calling party. Otherwise, thenetwork-generated ring back will be returned to the calling party. TheCN 7515 signals that the called party has answered, via the Connectmessage. The message is transferred (in Step 16) to the GANC 7510 andGANC forwards (in Step 16) the message to the UE 7505 in the GA-RRC DLDIRECT TRANSFER 7595. The UE 7505 connects the user to the audio path.If the UE 7505 is generating ring back, it stops and connects the userto the audio path.

The UE 7505 sends (in Step 17) the Connect Ack message in response, andthe two parties are connected for the voice call. This message iscontained within the GA-RRC UL DIRECT TRANSFER between the UE 7505 andthe GANC 7510. The GANC forwards (in Step 17) the Connect Ack message tothe CN 7515. Bi-directional voice traffic flows (in Step 18) between theUE 7505 and CN 7515 through the GANC 7510.

b) GANC Terminates Iu UP Packet

Some embodiments utilize an alternative procedure for the mobileoriginated CS call using RRC protocol. FIG. 76 illustrates stepsperformed during a mobile originated CS call in these embodiments. Theprocedure assumes that the UE is in GAN mode; i.e., it has successfullyregistered with the GANC and GA-RRC is the serving RR entity for CSservices in the UE. It also assumes that no GA-RRC signaling connectionexists between the UE and GANC (i.e., GA-RRC-IDLE state). As shown, theGA-RRC Connection Establishment procedure is performed (in Step 1). Insome embodiments, this procedure is performed. Next, the UE 7605 sendsthe CM Service Request message to the GANC 7610 within the GA-RRC ULDIRECT TRANSFER message.

Next, the GANC 7610 establishes an SCCP connection to the core networkCN 7615 and forwards (in Step 3) the NAS PDU (i.e., the CM ServiceRequest message) to the core network CN 7615 using the RANAP Initial UEMessage. The message includes the Domain Indicator set to value ‘CSdomain’. Subsequent NAS messages between the UE and core network CN willbe sent between GANC and core network CN using the RANAP Direct Transfermessage.

The core network CN 7615 may optionally authenticate (in Step 4) the UEusing standard UTRAN authentication procedures. The core network CN 7615may optionally initiate (in Step 5) the Security Mode Control procedure.The UE 7605 sends (in Step 6) the Setup message providing details on thecall to the core network CN and its bearer capability and supportedcodecs. This message is contained within the GA-RRC UL DIRECT TRANSFERbetween the UE and the GANC. The GANC forwards the Setup message to thecore network CN.

Next, the core network CN 7615 indicates (in Step 7) it has received thecall setup and it will accept no additional call-establishmentinformation using the Call Proceeding message to the GANC. The GANCforwards (in Step 7) this message to the UE in the GA-RRC DL DIRECTTRANSFER message.

The core network CN 7615 requests (in Step 8) the GANC 7610 to assigncall resources using the RANAP RAB Assignment Request message. The corenetwork CN 7615 includes the RAB-ID, the CN Transport Layer Address andthe CN Iu Transport Association for user data, and an indication that IuUP support mode is required, among other parameters.

The GANC 7610 then sends (in Step 9) the GA-RRC ACTIVATE CHANNEL messageto the UE 7605 including bearer path setup information such as: (1)Channel mode, (2) Multi-rate codec configuration, (3) UDP port & the IPaddress for the uplink RTP stream, and (4) Voice sample size.

Next, the UE 7605 sends (in Step 10) the GA-RRC ACTIVATE CHANNEL ACK tothe GANC7610 indicating the UDP port for the downlink RTP stream. SinceIu UP support mode is indicated by the core network CN in step 8, theGANC 7610 sends (in Step 11) the Iu UP INITIALIZATION packet to the corenetwork CN.

In response, the core network CN responds (in Step 12) with the Iu UPINITIALISATION ACK packet. The GANC 7610 signals (in Step 13) thecompletion of the RAB establishment to the UE 7605 with the GA-RRCACTIVATE CHANNEL COMPLETE message. Alternatively, Steps 11 and 12 mayoccur before Step 9.

The GANC 7610 signals to the core network CN 7615 that the RAB has beenestablished by sending (in Step 14) a RANAP RAB Assignment Responsemessage. The core network CN 7615 signals to the UE 3505, with theAlerting message, that the called party is ringing. The message istransferred (in Step 15) to the GANC 7610 and GANC forwards (in Step 15)the message to the UE 7605 in the GA-RRC DL DIRECT TRANSFER. When the UEhas not connected the audio path to the user, it generates ring back tothe calling party. Otherwise, the network-generated ring back will bereturned to the calling party.

Next, the core network CN 7615 signals that the called party hasanswered, via the Connect message. The message is transferred (in Step16) to the GANC 7610 and GANC forwards (in Step 16) the message to theUE in the GA-RRC DL DIRECT TRANSFER. The UE connects the user to theaudio path. If the UE is generating ring back, it stops and connects theuser to the audio path.

The UE 7605 then sends (in Step 17) the Connect Ack message in response,and the two parties are connected for the voice call. This message iscontained within the GA-RRC UL DIRECT TRANSFER between the UE and theGANC. The GANC forwards the Connect Ack message to the core network CN.At this time, bi-directional voice traffic flows (in Step 18) betweenthe UE 7605 and core network CN 7615 through the GANC 7610.

6. Mobile Terminated CS Call

FIG. 77 illustrates mobile terminated CS call procedure in someembodiments. The description of the procedure assumes the UE 7705 is inGAN mode; i.e., it has successfully registered with the GANC 7710 andGA-RRC is the serving RR entity in the UE 7705. It also assumes that noGA-RRC connection exists between the UE 7705 and GANC 7710 (i.e.,GA-RRC-IDLE state).

A mobile-terminated call arrives at the CN 7715. The CN 7715 sends (inStep 1) a RANAP Paging message to the GANC 7710 identified through thelast Location Update received by it and includes the TMSI if available.The IMSI of the mobile being paged is always included in the request.The GANC 7710 identifies the UE registration context using the IMSIprovided by the CN 7715. The GANC then pages (in Step 2) the UE 7705using the GA-RRC PAGING REQUEST message. The message includes the TMSI,when available in the request from the CN 7715. Otherwise, the messageincludes only the IMSI of the UE 7705.

The UE 7705 responds (in Step 3) with a GA-RRC INITIAL DIRECT TRANSFERmessage containing the Paging Response. The UE 7705 enters GA-RRCconnected mode. The GANC 7710 establishes an SCCP connection to the CN7715. The GANC 7710 then forwards (in Step 4) the paging response to theCN 7715 using the RANAP Initial UE Message. Subsequent NAS messagesbetween the UE 7705 and core network 7715 will be sent between GANC 7710and CN 7715 using the RANAP Direct Transfer message.

The CN 7715 may optionally authenticate (in Step 5) the UE 7705 usingstandard UTRAN authentication procedures. The CN 7715 may optionallyupdate (in Step 6) the security configuration in the UE 7705, via theGANC 7710, as described in Sub-section VIII.B.3: “Security ModeControl”, above. The CN 7715 initiates call setup using the Setupmessage sent (in Step 7) to the UE 7705 via GANC 7710. GANC forwards (inStep 7) this message to the UE 7705 in the GA-RRC DL DIRECT TRANSFERmessage.

The UE 7705 responds (in Step 8) with Call Confirmed using the GA-RRC ULDIRECT TRANSFER after checking it's compatibility with the bearerservice requested in the Setup and modifying the bearer service asneeded. If the Setup included the signal information element, the UE7705 alerts the user using the indicated signal, else the UE 7705 alertsthe user after the successful configuration of the user plane. The GANC7710 forwards (in Step 8) the Call Confirmed message to the CN 7715. TheCN 7715 initiates (in Step 9) the assignment procedure with the GANC7710, which triggers the setup of the RTP stream (voice bearer channel)between the GANC 7710 and UE 7705.

The UE 7705 signals (in Step 10) that it is alerting the user, via theAlerting message contained in the GA-RRC UL DIRECT TRANSFER. The GANC7710 forwards (in Step 10) the Alerting message to the CN 7715. The CN7715 sends a corresponding alerting message to the calling party. The UE7705 signals (in Step 11) that the called party has answered, via theConnect message contained in the GA-RRC UL DIRECT TRANSFER. The GANC7710 forwards (in Step 11) the Connect message to the CN 7715. The CN7715 sends a corresponding Connect message to the calling party andthrough connects the audio. The UE 7705 connects the user to the audiopath.

The CN 7715 acknowledges (in Step 12) via the Connect Ack message to theGANC 7710. GANC 7710 forwards (in Step 12) this message to the UE 7705in the GA-RRC DL DIRECT TRANSFER. The two parties on the call areconnected on the audio path. Bi-directional voice traffic flows (in Step13) between the UE 7705 and CN 7715 through the GANC 7710.

7. CS Call Clearing

FIG. 78 illustrates call clearing initiated by the UE in someembodiments. As shown, the UE 7805 sends (in Step 1) the Disconnectmessage to the CN 7815 to release the call. This message is contained inthe GA-RRC UL DIRECT TRANSFER message between UE 7805 and GANC 7810. TheGANC 7810 forwards (in Step 1) the Disconnect message to the CN 7815(i.e., using the RANAP Direct Transfer message).

The CN 7815 responds (in Step 2) with a Release message to the GANC7810. The GANC 7810 forwards (in Step 2) this message to the UE 7805using the GA-RRC DL DIRECT TRANSFER message.

The UE 7805 responds (in Step 3) with the Release Complete message. Thismessage is contained within the GA-RRC UL DIRECT TRANSFER messagebetween UE 7805 and GANC 7810. The GANC 7810 forwards (in Step 3) theDisconnect message to the CN 7815. The CN 7815 triggers (in Step 4) therelease of connection as described in Subsection VIII.B.1.b: “GA-CSRConnection Release”.

8. CS Handover

a) CS Handover from GERAN to GAN

i) UE Terminates Iu UP Packet

FIG. 79 illustrates the CS Handover from GERAN to GAN procedure in someembodiments. The description of the GERAN to GAN handover procedureassumes the following: (1) the UE is on an active call on the GERAN; (2)the UE mode selection is GAN-preferred, or if GERAN/UTRAN-preferred, theRxLev from the current serving cell drops below a defined threshold, insome embodiments this threshold can be specified as a fixed value, orprovided by the GERAN BSS to the UE in dedicated mode; (3) the UE hassuccessfully registered with a GANC, allowing the UE to obtain GANsystem information; and (4) the GERAN provides information onneighboring 3G cells such that one of the cells in the 3G neighbor listmatches the 3G cell information associated with the GANC, as provided inthe AS-related component of the system information obtained from theGANC.

The UE begins to include (in Step 1) GAN cell information in theMeasurement Report message to the GERAN. The UE reports the highestsignal level for the GAN cell. This is not the actual measured signallevel on GAN, rather an artificial value (i.e., RxLev=63), allowing theUE to indicate preference for the GAN.

Based on UE measurement reports and other internal algorithms, the GERANBSC decides to handover to the GAN cell. The BSC 7920 starts thehandover preparation by sending (in Step 2) a Handover Required messageto the CN 7915, identifying the target 3G RNC (GANC) 7910. The CN 7915requests (in Step 3) the target GANC 7910 to allocate resources for thehandover using the Relocation Request message. The UE 7905 is identifiedby the included IMSI parameter.

The GANC 7910 sends (in Step 4) the GA-RRC ACTIVATE CHANNEL message tothe UE 7905 including bearer path setup information received in theRelocation Request message, such as: (1) UDP port & the IP address forthe uplink RTP stream, (2) Radio Access Bearer (RAB) parameters, and (3)Iu UP parameters (e.g., Iu UP mode, where support mode is used for AMRvoice calls).

Since Iu UP support mode is indicated, the UE 7905 sends (in Step 5) theIu UP INITIALISATION packet to the IP address and UDP port indicated inthe GA-RRC ACTIVATE CHANNEL message. This message is routed to the corenetwork 7915 (e.g., the R4 media gateway).

The core network 7915 responds (in Step 6) with the Iu UP INITIALISATIONACK packet. The core network 7915 sends the message to the source IPaddress and UDP port number of the received INITIALISATION packet. TheUE 7905 sends (in Step 7) the GA-RRC ACTIVATE CHANNEL ACK to the GANC7910. The GANC 7910 builds a Handover to UTRAN Command message and sends(in Step 8) it to the CN 7915 through the Relocation Request Acknowledgemessage.

The GANC 7910 signals (in Step 9) the completion of the RABestablishment to the UE 7905 with the GA-RRC ACTIVATE CHANNEL COMPLETEmessage. An end-to-end audio path now exists between the UE 7905 and theCN 7915. The CN 7915 forwards (in Step 10) the Handover to UTRAN Commandmessage to the GERAN BSC 7920 in the BSSMAP Handover Command message,completing the handover preparation.

The GERAN BSC 7920 sends (in Step 11) the Intersystem to UTRAN HandoverCommand message, containing the Handover to UTRAN Command message, tothe UE to initiate handover to GAN. The UE does not switch its audiopath from GERAN to GAN until handover completion (i.e., until it sendsthe GA-RRC HANDOVER COMPLETE message) to keep the audio interruptionshort.

The UE accesses the GANC 7910 using (in Step 12) the GA-RRC HANDOVERACCESS message, and provides the entire Intersystem to UTRAN HandoverCommand message received from GERAN. The GANC 7910 indicates (in Step13) to the CN 7915 that it has detected the UE, using Relocation Detectmessage. The CN 7915 can optionally now switch the user plane from thesource GERAN to the target GAN. Bi-directional voice traffic is nowflowing (in Step 14) between the UE and CN 7915, via GANC 7910.

The UE transmits (in Step 15) the GA-RRC HANDOVER COMPLETE message toindicate the completion of the handover procedure at its end. Itswitches the user from the GERAN user plane to the GAN user plane.

The target GANC 7910 indicates (in Step 16) the handover is complete,using the Relocation Complete message. If it had not done so before, theCN 7915 now switches the user plane from source GERAN to target GAN.

Finally, the CN 7915 tears (in Step 17) down the connection to thesource GERAN, using Clear Command message. The source GERAN confirms (inStep 18) the release of GERAN resources allocated for this call, usingClear Complete message.

ii) GANC Terminates Iu UP Packet

FIG. 80 illustrates an alternative procedure for CS handover from GERANto GAN in some embodiments. The description of the GERAN to GAN handoverprocedure assumes the following: (1) the UE is on an active call on theGERAN, (2) the UE mode selection is GAN-preferred, or ifGERAN/UTRAN-preferred, the RxLev from the current serving cell dropsbelow a defined threshold. In some embodiments, this threshold can bespecified as a fixed value, or provided by the GERAN BSS to the UE indedicated mode, (3) the UE has successfully registered with a GANC,allowing the UE to obtain GAN system information, and (4) the GERANprovides information on neighboring 3G cells such that one of the cellsin the 3G neighbor list matches the 3G cell information associated withthe GANC, as provided in the AS-related component of the systeminformation obtained from the GANC. As shown, the UE 8005 begins toinclude GAN cell information in the Measurement Report message to theGERAN BSC 8015. The UE 8005 reports the highest signal level for the GANcell. This is not the actual measured signal level on GAN, rather anartificial value (e.g., RxLev=63), allowing the UE to indicatepreference for the GAN.

Based on UE measurement reports and other internal algorithms, the GERANBSC 8015 decides to handover to the GAN cell. The BSC 8015 starts thehandover preparation by sending (in Step 2) a Handover Required messageto the core network CN (8020), identifying the target 3G RNC (GANC).

The core network CN (8020) requests (in Step 3) the target GANC 8010 toallocate resources for the handover using the Relocation Requestmessage. The UE is identified by the included IMSI parameter.

Since Iu UP support mode is indicated, the GANC 8010 sends (in Step 4)the Iu UP INITIALISATION packet to the core network CN. The core networkCN responds (in Step 5) with the Iu UP INITIALISATION ACK packet.

The GANC 8010 builds a Handover to UTRAN Command message and sends it(in Step 6) to the core network CN 8020 through the Relocation RequestAcknowledge message. The core network CN forwards (in Step 7) theHandover to UTRAN Command message to the GERAN BSC 8015 in the BSSMAPHandover Command message, completing the handover preparation.

Next, the GERAN BSC 8015 sends (in Step 8) the Intersystem to UTRANHandover Command message, containing the Handover to UTRAN Commandmessage, to the UE 8005 to initiate handover to GAN. The UE does notswitch its audio path from GERAN to GAN until handover completion (i.e.,until it sends the GA-RRC HANDOVER COMPLETE message) to keep the audiointerruption short.

The UE 8005 accesses (in Step 9) the GANC 8010 using the GA-RRC HANDOVERACCESS message, and provides the entire Intersystem to UTRAN HandoverCommand message received from GERAN. The GANC 8010 sends (in Step 10)the GA-RRC ACTIVATE CHANNEL message to the UE 8005 including bearer pathsetup information such as: (1) Channel mode, (2) Multi-rate codecconfiguration, (3) UDP port & the IP address for the uplink RTP stream,and (4) Voice sample size.

Next, the UE 8005 sends (in Step 11) the GA-RRC ACTIVATE CHANNEL ACK tothe GANC 8010 indicating the UDP port for the downlink RTP stream. TheGANC 8010 signals (in Step 11) the completion of the RAB establishmentto the UE 8005 with the GA-RRC ACTIVATE CHANNEL COMPLETE message.

The UE 8005 transmits (in Step 13) the GA-RRC HANDOVER COMPLETE messageto indicate the completion of the handover procedure at its end. Itswitches the user from the GERAN user plane to the GAN user plane. TheGANC 8010 indicates (in Step 14) to the core network CN (8020) that ithas detected the UE, using Relocation Detect message. The CN canoptionally now switch the user plane from the source GERAN to the targetGAN.

Bi-directional voice traffic is now (in Step 15) flowing between the UE8005 and core network CN 8020, via GANC 8010. The target GANC 8010indicates (in Step 16) the handover is complete, using the RelocationComplete message. If it had not done so before, the CN now switches theuser plane from source GERAN to target GAN.

The CN tears down (in Step 17) the connection to the source GERAN, usingClear Command message. Finally, the source GERAN 8015 confirms (in Step18) the release of GERAN resources allocated for this call, using ClearComplete message.

b) CS Handover from UTRAN to GAN

i) UE Terminate Iu UP Packet

The description of the UTRAN to GAN Handover procedure assumes thefollowing: (1) the UE is on an active call on the UTRAN; (2) the UE hasbeen ordered by the RNC to make inter-frequency measurements. When theUE is in GAN preferred mode with an Event 2A configured, the UE handlesparameters associated with the Event 2A in a GAN specific manner (asdescribed in 3GPP TS 25.331) for the reporting of the GAN. When the UEis in GERAN/UTRAN preferred mode and an Event 2A has been configured forthe GAN cell, the UE shall only send a measurement about the GAN cell,when this event is triggered and no UTRAN cells from the neighbour celllist of the UE satisfy the triggering condition of this Event (asdescribed in 3GPP TS 25.331); and (3) the UTRAN provides information onneighbouring cells such that one of the cells in the neighbour listmatches the cell associated with the GANC, as provided in the AS-relatedcomponent of the system information obtained from GANC.

FIG. 81 illustrates the CS Handover from UTRAN to GAN procedure in someembodiments. The UE begins to include (in Step 1) information about aGAN cell in the Measurement Report message sent to the RNC 8120. The UEreports the highest signal level for the GAN cell. This is not theactual measured signal level on the GAN, rather an artificial valueallowing the UE to indicate preference for the GAN.

Based on UE measurement reports and other internal algorithms, the RNC8120 decides to initiate handover to the GAN cell. The RNC 8120 startsthe preparation phase of the Relocation procedure by sending (in Step 2)a Relocation Required message to the CN 8115, identifying the target(EGAN) cell.

The CN 8115 requests (in Step 3) the target GANC 8110 to allocateresources for the handover using the Relocation Request message. The UE8105 is identified by the included IMSI parameter.

The GANC 8110 sends (in Step 4) the GA-RRC ACTIVATE CHANNEL message tothe UE 8105 including bearer path setup information received in theRelocation Request message, such as: (1) UDP port & the IP address forthe uplink RTP stream, (2) Radio Access Bearer (RAB) parameters, and (3)Iu UP parameters (e.g., Iu UP mode, where support mode is used for AMRvoice calls).

Since Iu UP support mode is indicated, the UE 8105 sends (in Step 5) theIu UP INITIALISATION packet to the IP address and UDP port indicated inthe GA-RRC ACTIVATE CHANNEL message. This message is routed to the corenetwork 8115 (e.g., the R4 media gateway).

The core network 8115 responds (in Step 6) with the Iu UP INITIALISATIONACK packet. The core network 8115 sends the message to the source IPaddress and UDP port number of the received INITIALISATION packet. TheUE 8105 sends (in Step 7) the GA-RRC ACTIVATE CHANNEL ACK to the GANC8110.

The target GANC 8110 acknowledges (in Step 8) the handover requestmessage, using Relocation Request Acknowledge message, indicating it cansupport the requested handover, and including a Physical ChannelReconfiguration message that indicates the radio channel to which the UE8105 should be directed.

The GANC 8110 signals (in Step 9) the completion of the RABestablishment to the UE 8105 with the GA-RRC ACTIVATE CHANNEL COMPLETEmessage. An end-to-end audio path now exists between the UE 8105 and theCN 8115. The CN 8115 sends (in Step 10) the Relocation Command messageto the RNC 8120, completing the relocation preparation.

The RNC 8120 sends (in Step 11) the PHYSICAL CHANNEL RECONFIGURATIONmessage to the UE to initiate handover to GAN. The UE does not switchits audio path from UTRAN to GAN until handover completion (i.e., untilit sends the GA-RRC HANDOVER COMPLETE message) to keep the audiointerruption short. The UE accesses (in Step 12) the GANC 8110 using theGA-RRC HANDOVER ACCESS message, and provides the entire PHYSICAL CHANNELRECONFIGURATION message received from RNC 8120.

The GANC 8110 indicates (in Step 13) to the CN 8115 that it has detectedthe UE, using Relocation Detect message. The CN 8115 can optionally nowswitch the user plane from the source RNC 8120 to the target GANC 8110.Bi-directional voice traffic is now flowing (in Step 14) between the UEand CN 8115, via GANC 8110.

The UE transmits (in Step 15) the GA-RRC HANDOVER COMPLETE to indicatethe completion of the handover procedure from its perspective. Itswitches the user from the UTRAN user plane to the GAN user plane. Thetarget GANC 8110 indicates (in Step 16) the handover is complete, usingthe Relocation Complete message. If it has not done so before, the CN8115 now switches the user plane from source RNC 8120 to target GANC8110.

Finally, the CN 8115 tears (in Step 17) down the connection to thesource RNC 8120, using Iu Release Command. The source RNC 8120 confirms(in Step 18) the release of UTRAN resources allocated for this call,using Iu Release Complete.

ii) GANC Terminates Iu UP Packet

FIG. 82 illustrates an alternative procedure for CS handover from UTRANto GAN using RRC protocol in some embodiments. The description of theUTRAN to GAN Handover procedure assumes the following: (1) the UE is onan active call on the UTRAN, (2) the UE has been ordered by the RNC tomake inter-frequency measurements (i.e., if the GAN cell has beenallocated a different frequency value than is used in the UTRAN), (a) ifthe UE is in GAN preferred mode with an Event 2A configured, the UEhandles parameters associated with the Event 2A in a GAN specific mannerfor the reporting of the EGAN, (b) when the UE is in GERAN/UTRANpreferred mode and an event 2A has been configured for the GAN cell, theUE shall only send a measurement about the GAN cell, when this event istriggered and no UTRAN cells from the neighbor cell list of the UEsatisfy the triggering condition of this Event (as described in 3GPP TS25.331), (3) the UTRAN provides information on neighboring cells suchthat one of the cells in the neighbor list matches the cell associatedwith the GANC, as provided in the AS-related component of the systeminformation obtained from GANC.

As shown in FIG. 82, the UE 8205 begins to include information about aGAN cell in the Measurement Report message sent (in Step 1) to the RNC8215. The UE 8205 reports the highest signal level for the GAN cell.This is not the actual measured signal level on the GAN, rather anartificial value allowing the UE 8205 to indicate preference for theGAN.

Based on UE measurement reports and other internal algorithms, the RNC8215 decides to initiate handover to the GAN cell. The RNC 8215 startsthe preparation phase of the Relocation procedure by sending (in Step 2)a Relocation Required message to the core network CN, identifying thetarget (GAN) cell.

Next, steps 3 to 5 shown in FIG. 82 are performed similar to steps 3-5for CSR GERAN to GAN Handover “GANC Terminates Iu UP Packets”Sub-section described above, except that the messages are RRC messages(instead of CSR). The target GANC 8210 acknowledges (in Step 6) thehandover request message, using Relocation Request Acknowledge message,indicating it can support the requested handover, and including aPhysical Channel Reconfiguration message that indicates the radiochannel to which the UE should be directed.

Next, the core network CN 8220 sends (in Step 7) the Relocation Commandmessage to the RNC 8215, completing the relocation preparation. The RNC8215 sends (in Step 8) the PHYSICAL CHANNEL RECONFIGURATION message tothe UE 8205 to initiate handover to GAN. The UE does not switch itsaudio path from UTRAN to GAN until handover completion (i.e., until itsends the GA-RRC HANDOVER COMPLETE message) to keep the audiointerruption short.

Next, Steps 9-16 shown in FIG. 82 are performed similar to Steps 9-16for CSR GERAN to GAN Handover in “GANC Terminates Iu UP Packets”Sub-section described above, except that Steps 9-16 in FIG. 82 utilizeRRC protocol instead of CSR protocol. Next, the core network CN 8220tears down (in Step 17) the connection to the source RNC, using IuRelease Command. Finally, the source RNC 8215 confirms (in Step 18) therelease of UTRAN resources allocated for this call, using Iu ReleaseComplete.

c) CS Handover from GAN to GERAN

The procedure description in this sub-clause assumes the following: (1)the UE is on an active call on the EGAN; and (2) the GERAN becomesavailable and (i) the UE mode selection is GERAN/UTRAN-preferred, or(ii) the UE mode selection is GAN-preferred and the UE begins to leaveGAN coverage, based on its local measurements, received RTCP reports, aswell as any uplink quality indications received from the GANC.

The handover from GAN to GERAN procedure is always triggered by the UE.

FIG. 83 illustrates the CS handover from GAN to GERAN procedure in someembodiments. The GANC 8310 may send (in Step 1) a GA-RRC UPLINK QUALITYINDICATION if there is a problem with the uplink quality for the ongoingcall. Uplink Quality Indication is information sent by the GANC 8310 tothe UE 8305 indicating the crossing of an uplink quality threshold inthe uplink direction. Whenever the UE 8305 receives an indication of badquality, it should start the handover procedure, as described in thenext step. Alternatively, UE 8305 can use its local measurements orreceived RTCP reports, to decide to initiate the handover procedure.

The UE 8305 sends (in Step 2) the GA-RRC HANDOVER INFORMATION message tothe GANC 8310 indicating the Channel Mode and a list of target GERANcells, identified by CGI, in order of preference (e.g. ranked by Cl pathloss parameter) for handover, and includes the received signal strengthfor each identified GERAN cell. This list is the most recent informationavailable from the GSM RR subsystem. In addition, the GA-RRC HANDOVERINFORMATION message may include a list of target UTRAN cells ranked inorder of preference for handover, and the received signal strength foreach identified UTRAN cell.

If the Serving GANC 8310 selects a target GERAN cell, the handover toGERAN procedure is performed. The Serving GANC 8310 starts the handoverpreparation by signaling (in Step 3) to the CN 8315 the need forhandover, using Relocation Required, and including the GERAN cell listprovided by the UE 8305. The GANC 8310 may include only a subset of thecell list provided by the UE 8305.

The CN 8315 selects a target GERAN cell and requests (in Step 4) it toallocate the necessary resources, using Handover Request. The targetGERAN builds a Handover Command message providing information on thechannel allocated and sends (in Step 5) it to the CN 8315 through theHandover Request Acknowledge message.

The CN 8315 signals (in Step 6) the GANC 8310 to handover the UE 8305 tothe GERAN, using Relocation Command message, ending the handoverpreparation phase. GANC 8310 transmits (in Step 7) the GA-RRC HANDOVERCOMMAND to the UE 8305 including the details sent by the GERAN on thetarget resource allocation. The UE 8305 transmits (in Step 8) the Um:Handover Access containing the handover reference element to allow thetarget GERAN to correlate this handover access with the Handover Commandmessage transmitted earlier to the CN 8315 in response to the HandoverRequired.

The target GERAN confirms (in Step 9) the detection of the handover tothe CN 8315, using the Handover Detect message. The CN 8315 may at thispoint switch (in Step 10) the user plane to the target BSS. The GERANprovides (in Step 11) Physical Information to the UE 8305 (i.e., TimingAdvance) to allow the UE 8305 to synchronize with the GERAN. The UE 8305signals (in Step 12) to the GERAN that the handover is completed, usingHandover Complete.

The GERAN confirms (in Step 13) to the CN 8315 the completion of thehandover, via Handover Complete message. The CN 8315 may use the targetCGI used in the Handover procedure for charging purposes. Bi-directionalvoice traffic is now flowing (in Step 14) between the UE 8305 and CN8315, via the GERAN.

On receiving the confirmation of the completion of the handover, the CN8315 indicates (in Step 15) to the GANC 8310 to release any resourcesallocated to the UE 8305, via the Iu Release Command. GANC 8310 commands(in Step 16) the UE 8305 to release resources, using the GA-RRC RELEASEmessage. GANC 8310 confirms (in Step 17) resource release to CN 8315using the Iu Release Complete message.

The UE 8305 confirms (in Step 18) resource release to the GANC 8310using the GA-RRC RELEASE COMPLETE message. The UE 8305 may finallyderegister (in Step 19) from the GANC 8310, using GA-RC DEREGISTERmessage.

d) CS Handover from GAN to UTRAN

The procedure description in this sub-clause assumes the following: (1)the UE is on an active call on the GAN; (2) the UE is capable ofoperating in all of the GAN, GERAN and UTRAN modes; and (3) the UTRANbecomes available and (i) the UE is in GERAN/UTRAN-preferred mode, or(ii) the UE mode selection is GAN preferred and begins to leave GANcoverage, based on its local measurements, received RTCP reports, aswell as any uplink quality indications received from the GANC.

FIG. 84 illustrates the CS handover from GAN to UTRAN procedure in someembodiments. The handover from GAN procedure is always triggered by theUE 8405. The GANC 8410 may send (in Step 1) a GA-RRC UPLINK QUALITYINDICATION if there is a problem with the uplink quality for the ongoingcall. Uplink Quality Indication is information sent by the GANC 8410 tothe UE 8405 indicating the crossing of an uplink quality threshold inthe uplink direction. Whenever the UE 8405 receives an indication of badquality, it should start the handover procedure, as described in thenext step. Alternatively, UE 8405 can use its local measurements orreceived RTCP reports, to decide to initiate the handover procedure.

The UE 8405 sends (in Step 2) the GA-RRC HANDOVER INFORMATION message tothe Serving GANC 8410 indicating the Channel Mode and a list ofcandidate target UTRAN and GERAN cells, in order of preference forhandover, and includes the received signal strength for each identifiedcell. The UTRAN cells are identified by the PLMN ID, the LAC and the 3GCell identity (defined in 3GPP TS 25.331).

If the Serving GANC 8410 selects UTRAN as the target RAT, the handoverto UTRAN procedure is performed. The Serving GANC 8410 starts thehandover preparation by signaling (in Step 3) to the CN 8415 the needfor handover, using Relocation Required and including the UTRAN celllist provided by the UE 8405. The GANC 8410 may include only a subset ofthe cell list provided by the UE 8405.

The CN 8415 starts the handover procedure towards the target RNC 8420identified by the Serving GANC 8410. The CN 8415 requests (in Step 4)from the target RNC 8420 to allocate the necessary resources usingRelocation Request. The target RNC 8420 builds a Physical ChannelReconfiguration message providing information on the allocated UTRANresources and sends (in Step 5) it to the CN 8415 through the RelocationRequest Acknowledge message.

The CN 8415 signals (in Step 6) the Serving GANC 8410 to handover the UE8405 to the UTRAN, using Relocation Command message (which includes thePhysical Channel Reconfiguration message), ending the handoverpreparation phase. The Serving GANC 8410 transmits (in Step 7) theGA-RRC HANDOVER COMMAND to the UE 8405 including the details sent by theUTRAN on the target resource allocation.

Target RNS achieves (in Step 8) uplink synchronization on the Uuinterface. The target RNC 8420 confirms (in Step 9) the detection of thehandover to the CN 8415, using the Relocation Detect message. The CN8415 may at this point switch (in Step 10) the user plane to the targetRNS. The UE 8405 signals (in Step 11) to the UTRAN that the handover iscompleted, using Handover to UTRAN Complete.

The UTRAN confirms (in Step 12) to the CN 8415 the completion of thehandover, via Relocation Complete message. If the user plane has notbeen switched in Step 10, the CN 8415 switches the user plane to thetarget RNS. Bi-directional voice traffic is now flowing (in Step 13)between the UE 8405 and CN 8415, via the UTRAN.

On receiving the confirmation of the completion of the handover, the CN8415 indicates (in Step 14) to the Serving GANC 8410 to release anyresources allocated to the UE 8405, via the Iu Release Command. TheServing GANC 8410 commands (in Step 15) the UE 8405 to releaseresources, using the GA-RRC RELEASE message.

The Serving GANC 8410 confirms (in Step 16) resource release to CN 8415using the Iu Release Complete message. The UE 8405 confirms (in Step 17)resource release to the Serving GANC 8410 using the GA-RRC RELEASECOMPLETE message. The UE 8405 may finally deregister (in Step 18) fromthe Serving GANC 8410, using GA-RC DEREGISTER message.

9. GA-RRC Packet Transport Channel Management Procedures

The GA-RRC Packet Transport Channel (GA-RRC PTC) provides theassociation between the UE and the network for the transport of GPRSuser data over the Up interface (i.e., via the GAN in Iu-mode). The PTCuses the GTP-U protocol running over UDP transport. The endpointaddresses of the PTC are identified by the IP addresses and UDP portsassigned to the PTC in the UE and network during the PTC activationprocedure. The UDP port number for GTP-U is as defined in 3GPP TS25.414. Multiple PTC instances between a UE and the network may beactivated at the same time, using the same endpoint addresses. Each PTCinstance is assigned unique GTP-U Tunnel Endpoint IDs (one on the UE andone on the network) during the activation procedure. The UE and GANCmanage the activation and deactivation of the PTC instances based on therequests for data transfer and the configurable PTC Timer.

a) States of the GA-RRC Packet Transport Channel

The UE in the GA-RRC-CONNECTED state can be in one of two PTC substates:PTC-STANDBY or PTC-ACTIVE. PTC-STANDBY: this is the initial/default PTCsubstate of the UE when in the GA-RRC-CONNECTED state in GAN mode. TheUE is not able to send or receive GPRS user data to or from the network.The UE needs to activate the PTC before sending any GPRS user data. Whenthe UE successfully establishes a PTC, the UE transitions to thePTC-ACTIVE substate. PTC-ACTIVE the UE is in the GA-RRC-CONNECTED stateand the PTC is active between the UE and the network and the UE is ableto send and receive GPRS user data to and from the network. Thefollowing are the possible triggers for GA-RRC PTC activation on the UEside: (1) The UE initiates the uplink user data transfer, and (2) theGANC initiates PTC activation; i.e., the UE receives aGA-RRC-ACTIVATE-PTC-REQUEST message from the GANC.

On successful PTC activation and in parallel with transition to thePTC-ACTIVE substate, the UE starts the PTC Timer. When the PTC Timerexpires, the UE sends a message to the GANC to initiate PTCdeactivation. On successful PTC deactivation, the UE transitions toPTC-STANDBY substate. At any time while in the GA-RRC-CONNECTED stateand the PTC-ACTIVE substate, the UE may receive the GA-RRC RELEASEmessage. In addition to requesting release of the RRC session, this isinterpreted by the UE as an implicit PTC deactivate command. At any timewhile in GAN mode, if the serving RR entity is switched toGSM-RR/UTRAN-RRC, the GA-RRC is disconnected from the GPRS SAPs and theUE enters GERAN/UTRAN mode. Simultaneously, the UE will release theassociated PTC regardless of the PTC Timer status. The UE GA-RRC entitymaintains one PTC for each active PDP context. The PTC Timer isrestarted whenever any uplink user data packet is sent or downlink userdata packet is received related to the PDP context. The PTC Timer valueis provided to the UE as part of the GAN Registration procedure (i.e.,in the GA-RC REGISTER ACCEPT message).

b) PTC Initial Activation

FIG. 85 illustrates the Packet Transport Channel initial activationprocedure of some embodiments. The following description assumes the UE8505 is in the GA-RRC-IDLE state, in some embodiments. The GA-RRCConnection Establishment procedure is performed (in Step 1) as describedin clause UE Initiated GA-RRC Connection Establishment, above. The UE8505 transitions to the GA-RRC-CONNECTED state and the PTC-STANDBYsubstate. Additional PS signaling procedures are performed (in Step 2).

The CN 8510 (SGSN) initiates (in Step 3) the RAB Assignment procedureand includes the RAB-ID, the CN Transport Layer Address (IP address) andthe CN Iu Transport Association (GTP-U Terminal Endpoint Identifier,TEID) for user data. The GANC 8515 sends (in Step 4) the GA-RRC ACTIVATEPTC REQUEST message to the UE 8505 to request activation of the PacketTransport Channel. The message includes the RAB-ID, and the CN IPAddress and TEID to allow the UE 8505 to send PTC packets (i.e., GTP-Umessages) directly to the SGSN.

The UE 8505 acknowledges (in Step 5) the PTC activation and provides theTransport Layer Address (IP address) and Iu Transport Association (GTP-UTEID) that identifies the UE end of the PTC. The UE 8505 transitions tothe PTC-ACTIVE substate and starts the PTC Timer.

Upon receiving the acknowledgment, the GANC 8515 sends (in Step 6) theRAB Assignment Response message to the CN 8510 (SGSN) to complete theRAB Assignment procedure and includes UE IP Address and GTP-U TEID.Additional PS signalling procedures are performed (in Step 7); examplesare illustrated in PDP Context Activation and Network Requested PDPContext Activation Sub-sections, below. The UE 8505 initiates (in Step8) uplink user data transfer via the established PTC and the CN 8510(SGSN) may use the same transport channel to send downlink user datapackets.

c) PTC Data Transfer

FIG. 86 illustrates the transfer of GPRS user data packets via the GANPacket Transport Channel in some embodiments. If required, the GAN PTCis established (in Step 1) as specified in Sub-section VIII.B.9.b: “PTCInitial Activation”, above. Upon the GA-RRC PTC establishment, the UE8605 enters the PTC-ACTIVE substate and starts the PTC Timer. The UE8605 initiates (in Step 2) the transfer of an uplink user data packetusing the standard GTP-U protocol as specified in 3GPP TS 29.060 andrestarts the PTC Timer.

The CN 8615 (SGSN) transfers (in Step 3) downlink user data packetutilizing the same PTC associated with the specific PDP context.Downlink user data packets are transferred using the standard GTP-Uprotocol as specified in 3GPP TS 29.060. Upon receiving the downlinkdata packet, the UE restarts the associated PTC Timer. Additional uplinkand downlink user data packets are transferred (in Step 4) via the samePTC as described in steps 2 and 3, respectively. After eachtransmission/reception, the UE 8605 restarts the PTC Timer.

d) UE Initiated PTC Deactivation

FIG. 87 illustrates the scenario when the UE deactivates the PacketTransport Channel after the PTC Timer expires in some embodiments. TheUE 8705 is (in Step 1) in the GA-RRC-CONNECTED state and the PTC-ACTIVEsubstate. The PTC Timer associated with one of the active packettransport channels expires.

The UE 8705 sends (in Step 2) the GA-RRC DEACTIVATE PTC REQUEST messageto the GANC 8710, including the RAB-ID to identify the PTC andindicating the normal release as a cause for deactivation. The GANC 8710sends (in Step 3) a RAB Release Request message to the CN (SGSN) 8715 torequest the release of the associated RAB. The CN (SGSN) 8715 responds(in Step 4) with the RAB Assignment Request indicating release.

The GANC 8710 responds (in Step 5) to the UE 8705 with a GA-RRCDEACTIVATE PTC ACK message to acknowledge successful deactivation. TheUE 8705 transitions to the PTC-STANDBY substate. The GANC 8710 sends (inStep 6) the RAB Assignment Response message to notify the SGSN 8715 thatthe RAB Release procedure is complete.

e) UE Initiated PTC Re-Activation

FIG. 88 illustrates the scenario when the UE initiates re-activation ofthe Packet Transport Channel in some embodiments. The UE is in theGA-RRC-CONNECTED and PMM-CONNECTED states; e.g., a PS signalingconnection and active PDP context exists between the UE 8805 and CN 8815but the PTC was previously deactivated by the UE 8805 due to PTC Timerexpiry in some embodiments. The UE 8805 is in the GA-RRC-CONNECTED stateand the PTC-STANDBY substate. The UE 8805 is in the PMM-CONNECTED state(i.e., a PS signaling connection and an active PDP context exists).

The UE 8805 has a PDU to send. The UE 8805 sends (in Step 1) the ServiceRequest message (with Service type value “Data”) to the GANC 8810 in theGA-RRC UL DIRECT TRANSFER message. The GANC 8810 forwards (in Step 2)the Service Request over the existing signaling connection to the CN8815 using the RANAP Direct Transfer message.

The CN 8815 may optionally initiate (in Step 3) the Security ModeControl procedure described in Sub-section VIII.B.3: “Security ModeControl”, above. The CN 8815 responds (in Step 4) with a Service Acceptmessage. The GANC 8810 forwards (in Step 5) the message to the UE 8805.

The UE 8805, GANC 8810 and CN 8815 establish (in Step 6) the GA-RRCPacket Transport Channel (PTC) as described in steps 3-6 in VIII.B.9.b:“PTC Initial Activation”, above. The UE 8805 transitions to thePTC-ACTIVE substate and starts the PTC Timer. The UE 8805 sends (in Step7) the uplink PDU. Additional data transfer may take place.

f) Network Initiated PTC De-Activation

FIG. 89 illustrates the scenario when the network initiatesde-activation of the Packet Transport Channel in some embodiments. TheUE 8905 is in the GA-RRC-CONNECTED state and the PTC-ACTIVE substate.

Optionally, the GANC 8910 may initiate the PTC de-activation procedure;e.g., as a result of an error handling procedure. If so, the GANC 8910sends (in Step 1) the RAB Release Request message to the CN 8915. The CN(SGSN) 8915 sends (in Step 2) a RAB Assignment Request to request therelease of the associated RAB. The release request may include one ormore RABs.

The GANC 8910 requests (in Step 3) deactivation of the associated GA-RRCPTC by sending the GA-RRC DEACTIVATE PTC REQUEST message to the UE 8905.The UE 8905 transitions to the PTC-STANDBY substate, stops the PTC Timerand sends (in Step 4) the acknowledgment back to the GANC 8910. Steps 3and 4 are repeated for each additional RAB/PTC that needs to bereleased. The GANC 8910 notifies (in Step 5) the CN (SGSN) 8915 that therelease was successful.

g) Network Initiated PTC Re-Activation

FIG. 90 illustrates the scenario when the network initiatesre-activation of the Packet Transport Channel in some embodiments. TheUE 9005 is in the GA-RRC-CONNECTED and PMM-CONNECTED states; e.g., a PSsignaling connection and active PDP context exists between the UE and CNbut the PTC was previously deactivated in some embodiments. The UE 9005is in the GA-RRC-CONNECTED state and the PTC-STANDBY substate. The UE9005 is in the PMM-CONNECTED state (i.e., a PS signaling connection andan active PDP context exists).

The CN 9015 has a PDU to send to send to the UE 9005. The CN 9015 mayoptionally initiate (in Step 1) the Security Mode Control proceduredescribed in Sub-section VIII.B.3: “Security Mode Control”, above. TheUE 9005, GANC 9010 and CN 9015 establish (in Step 2) the GA-RRC PacketTransport Channel (PTC) as described in steps 3-6 in clause inSub-section VIII.B.9.b: “PTC Initial Activation”, above. The UE 9005transitions to the PTC-ACTIVE substate and starts the PTC Timer. The CN9015 sends (in Step 3) the downlink PDU. Additional data transfer maytake place.

h) Implicit PTC De-Activation Due to UE De-Registration

FIG. 96 illustrates the procedure for implicit PTC de-activation in someembodiments. As part of the GAN de-registration procedure, the GANCneeds to release all resources allocated to that UE 9605. GANde-registration may be initiated either explicitly by the UE 9605 orimplicitly by the GANC 9610 if the loss of the signaling connection isdetected. Initially, one or more GA-RRC PTCs associated with a UE 9605are in the PTC-ACTIVE state.

The GAN de-registration procedure is initiated (in Step 1) for the UE9605 either by the UE 9605 or GANC 9610. Optionally, any outstandingresources associated with the CS Domain are released (in Step 2).Optionally, if there are any outstanding resources associated with thePS Domain, the GANC 9610 initiates (in Step 3) the Iu release procedureto release the corresponding RABs. The CN (SGSN) 9615 responds (in Step4) with Iu Release Command. Upon receiving the Iu Release Command, theGANC 9610 locally deactivates (in Step 5) all associated PTCs andresponds (in Step 6) to the core network (SGSN) 9615 with an Iu ReleaseComplete message.

10. PDP Context Activation

FIG. 91 illustrates the successful UE-initiated PDP Context Activationprocedure, assuming the UE is in GA-RRC-IDLE mode in some embodiments.The GA-RRC Connection Establishment procedure is performed (in Step 1)as described in Sub-section UE Initiated GA-RRC ConnectionEstablishment, above. If a GA-RRC connection already exists (e.g., thereis an existing CS call in progress), this step is skipped.

Upon request from the upper layers, the UE 9105 sends (in Step 2) theService Request message (with Service type value “Signaling”) to theGANC 9110 in the GA-RRC INITIAL DIRECT TRANSFER message. The GANC 9110establishes an SCCP connection to the CN 9115 and forwards (in Step 3)the Service Request to the CN 9115 using the RANAP Initial UE Message.Subsequent NAS messages between the UE 9105 and core network 9115 willbe sent between GANC 9110 and CN 9115 using the RANAP Direct Transfermessage.

The CN 9115 may optionally authenticate (in Step 4) the UE 9105 usingstandard UTRAN authentication procedures. The CN 9115 may optionallyinitiate (in Step 5) the Security Mode Control procedure described inSub-section VIII.B.3: “Security Mode Control”, above.

The CN (SGSN) 9115 responds (in Step 6) with a Service Accept message.The GANC 9110 forwards (in Step 6) the message to the UE 9105. The UE9105 sends (in Step 7) the Activate PDP Context Request messageproviding details on the PDP context to the CN 9115. This message iscontained within the GA-RRC UL DIRECT TRANSFER between the UE 9105 andthe GANC 9110. The GANC 9110 forwards (in Step 7) the Activate PDPContext Request message to the CN 9115.

The UE 9105, GANC 9110 and CN 9115 establish (in Step 8) the GA-RRCPacket Transport Channel (PTC) as described in steps 3-6 in Sub-sectionVIII.B.9.b: “PTC Initial Activation”, above. The CN 9115 indicates (inStep 9) the PDP context establishment is complete using the Activate PDPContext Accept message to the GANC 9110. GANC forwards (in Step 9) thismessage to the UE 9105 in the GA-RRC DL DIRECT TRANSFER message. The UE9105 and CN 9115 exchange (in Step 10) user data transfer via theestablished PTC.

11. Network Requested PDP Context Activation

FIG. 92 illustrates the successful Network-Requested PDP ContextActivation procedure, assuming the UE is in GA-RRC-IDLE mode, in someembodiments. Initially, the CN (SGSN) 9215 received downlink user datato transfer to the UE and the associated RAB is not established. The UEis in PMM-IDLE state.

The CN (SGSN) 9215 sends (in Step 1) the RANAP Paging message to the UE9205 via the GANC 9210 to locate the user. The paging request indicatespaging for PS Domain signaling. The GANC 9210 forwards (in Step 2) thepaging information to the UE 9205 in the GA-RRC PAGING REQUEST message.

The UE 9205 responds (in Step 3) to the SGSN 9215 via the GANC 9210 witha Service Request message (with Service type value “Paging response”).The message is encapsulated within the GA-RRC INITIAL DIRECT TRANSFERmessage. The GANC 9210 forwards (in Step 4) the Service Request messageto the SGSN 9215 encapsulated in the RANAP Initial UE Message.

The CN 9215 may optionally authenticate (in Step 5) the UE 9205 usingstandard UTRAN authentication procedures. The CN 9215 may optionallyinitiate (in Step 6) the Security Mode Control procedure described inSub-section VIII.B.3: “Security Mode Control”, above.

The CN 9215 sends (in Step 7) the Request PDP Context Activation messageto the GANC 9210. The GANC 9210 forwards (in Step 7) this message to theUE 9205 in the GA-RRC DL DIRECT TRANSFER message.

The UE 9205 sends (in Step 8) the Activate PDP Context Request messageproviding details on the PDP context to the CN 9215. This message iscontained within the GA-RRC UL DIRECT TRANSFER between the UE 9205 andthe GANC 9210. The GANC forwards (in Step 8) the Activate PDP ContextRequest message to the CN 9215. The UE 9205, GANC 9210 and CN 9215establish (in Step 9) the GA-RRC Packet Transport Channel (PTC) asdescribed in steps 3-6 in Sub-section VIII.B.9.b: “PTC InitialActivation”, above.

The CN 9215 indicates (in Step 10) the PDP context establishment iscomplete using the Activate PDP Context Accept message to the GANC 9210.GANC forwards (in Step 10) this message to the UE 9205 in the GA-RRC DLDIRECT TRANSFER message. The UE 9205 and CN 9215 exchange (in Step 11)user data transfer via the established PTC.

12. PDP Context Activation with Active CS Session

FIG. 93 illustrates the successful UE-initiated PDP Context Activationprocedure, assuming the UE 9305 is in GA-RRC-CONNECTED mode (e.g.,existing CS session) in some embodiments. The GA-RRC ConnectionEstablishment procedure is performed as described in Sub-section UEInitiated GA-RRC Connection Establishment, above. If a GA-RRC connectionalready exists (e.g., there is an existing CS call in progress), thisstep is skipped.

Upon request from the upper layers, the UE 9305 sends (in Step 1) theService Request message (with Service type value “Signaling”) to theGANC 9310 in the GA-RRC INITIAL DIRECT TRANSFER message. The GANC 9310establishes (in Step 2) an SCCP connection to the CN 9315 and forwardsthe Service Request to the CN using the RANAP Initial UE Message.Subsequent NAS messages between the UE 9305 and core network 9315 willbe sent between GANC 9310 and CN 9315 using the RANAP Direct Transfermessage.

The CN 9315 may optionally authenticate (in Step 3) the UE 9305 usingstandard UTRAN authentication procedures. The CN 9315 may optionallyinitiate (in Step 4) the Security Mode Control procedure described inSub-section VIII.B.3: “Security Mode Control”, above.

The CN (SGSN) 9315 responds (in Step 5) with a Service Accept message.The GANC 9310 forwards (in Step 5) the message to the UE 9305. The UE9305 sends (in Step 6) the Activate PDP Context Request messageproviding details on the PDP context to the CN 9315. This message iscontained within the GA-RRC UL DIRECT TRANSFER between the UE 9305 andthe GANC 9310. The GANC forwards (in Step 6) the Activate PDP ContextRequest message to the CN 9315.

The UE 9305, GANC 9310 and CN 9315 establish (in Step 7) the GA-RRCPacket Transport Channel (PTC) as described in steps 3-6 in Sub-sectionVIII.B.9.b: “PTC Initial Activation”, above. The CN 9315 indicates (inStep 8) the PDP context establishment is complete using the Activate PDPContext Accept message to the GANC 9310. GANC forwards (in Step 8) thismessage to the UE 9305 in the GA-RRC DL DIRECT TRANSFER message. The UE9305 and CN 9315 exchange (in Step 9) user data transfer via theestablished PTC.

13. SRNS Relocation

Serving RNS Relocation Procedure is performed for an UE in PMM-CONNECTEDstate to move the RAN connection point from old RNC to the new RNC. Twoscenarios will be considered: (1) SRNS Relocation from RNC to GANC; i.efrom UTRAN to GAN, and (2) SRNS Relocation from GANC to RNC; i.e., fromGAN to UTRAN. These procedures include several options based on thesupport for Iur interface and lossless SRNS Relocation. It is assumed inthis version of the GAN Specification that the Iur interface is notsupported. Additionally, given that PDCP protocol is not included in theGAN solution in order to optimize the data transport, it is assumed thatthe lossless SRNS Relocation is not supported either.

a) SRNS Relocation from UTRAN to GAN

FIG. 94 illustrates SRNS relocation procedure from UTRAN to GAN for a UEthat is in PMM Connected state in some embodiments. It is assumed thatIur interface and lossless SRNS relocation procedure are not supported.Initially, the ULE 9405 is registered for GAN service and in PMMConnected state. At lease one PDP context is active with maximum bitratehigher than 0.

After detecting GAN coverage and successfully registering for GANservice, the UE 9405 sends (in Step 1) measurement report to the RNC9410 indicating the highest signal level for the GAN cell. The RNC 9410sends (in Step 2) Relocation Required message to the core network (SGSN)9420 to initiate the SRNS relocation procedure. The message indicatesthe GANC 9415 as a target RNC 9410 and includes the informationnecessary for the relocation coordination.

The core network (SGSN) 9420 forwards (in Step 3) the request to theGANC 9415. The message includes the list of the RABs that need to besetup and associated information. Based on the Relocation Requestmessage, the CN 9420 and GANC 9415 establish (in Step 4) requested RABsand associated PS Transport Channels as specified in GA-RRC PacketTransport Channel Management Procedures Sub-section, above.

The GANC 9415 responds (in Step 5) to the core network 9420 withacknowledgment including Target RNC 9410 to Source RNC TransportContainer. The core network (SGSN) 9420 proceeds (in Step 6) withrelocation by sending a Relocation Command to the old RNC that includesthe Target RNC to Source RNC Transport Container.

The RNC 9410 starts forwarding (in Step 7) of data to the UE 9405 forthe RABs that are subject to forwarding. The forwarding is performed fordownlink user data only and is based on the Transport Layer Address andIu Transport Association received from the GANC 9415.

The RNC 9410 sends (in Step 8) the PHYSICAL CHANNEL RECONFIGURATIONmessage to the UE 9405 to initiate relocation to GAN. The RNC 9410continues with relocation by forwarding (in Step 9) the SRNS Contextinformation to the GANC 9415 via the core network (SGSN) 9420. The corenetwork (SGNS) 9420 forwards (in Step 10) the SRNS Context to the GANC9415. The GANC 9415 responds (in Step 11) with a Relocation Detectmessage.

The UE 9405 sends (in Step 12) a GA-RRC Relocation Complete message tothe GANC 9415 to indicate successful relocation. The GANC 9415 sends (inStep 13) the Relocation Complete message to the core network (SGSN) 9420to complete the procedure.

Upon receiving the Relocation Complete message, the core network (SGSN)9420 switches user plane from RNC 9410 to GANC (UE) and initiates (inStep 14) Iu Release procedure towards the RNC 9410. After the dataforwarding timer expires and after releasing the associated resources,the RNC 9410 responds (in Step 15) with Iu Release Complete message tothe core network (SGSN) 9420.

14. Short Message Service

GAN provides support for both Circuit Switched and Packet Switched SMSservices. GAN-attached and GPRS enabled UEs will be able to send andreceive SMS messages via the GAN.

a) CS-Based SMS

CS-based SMS support in GAN is based on the same mechanism that isutilized for CS mobility management and call control. On the UE side,the SMS layers (including the supporting CM sub layer functions) utilizethe services of the MM layer to transfer SMS messages per standardcircuit switched UMTS implementation. The SM-CP protocol is effectivelytunneled between the UE and the CN, using GA-RRC messages from the UE tothe GANC, where the GANC relays the SM-CP to RANAP messages fortransport over the Iu-cs interface. As with the mobility management andcall control procedures, the secure IPSec tunnel and TCP session areused to provide secure and reliable SMS delivery over the IP network.

b) PS-Based SMS

PS-based SMS message transfer is based on the same mechanism as thetransfer of the PS mobility management and session management signalingmessages. On the UE side, the SMS layers (including the supporting CMsub layer functions) utilize the services of the RRC (i.e., GA-RRC)layer to transfer SMS messages per standard packet switched UMTSimplementation. As with mobility management and session managementsignaling, the secure IPsec tunnel and TCP session is used to providesecure and reliable PS-based SMS delivery over the IP network.

IX. COMPUTER SYSTEM

FIG. 95 conceptually illustrates a computer system with which someembodiments of the invention are implemented. The computer system 9500includes a bus 9505, a processor 9510, a system memory 9515, a read-onlymemory 9520, a permanent storage device 9525, input devices 9530, andoutput devices 9535.

The bus 9505 collectively represents all system, peripheral, and chipsetbuses that support communication among internal devices of the computersystem 9500. For instance, the bus 9505 communicatively connects theprocessor 9510 with the read-only memory 9520, the system memory 9515,and the permanent storage device 9525.

From these various memory units, the processor 9510 retrievesinstructions to execute and data to process in order to execute theprocesses of the invention. In some embodiments the processor comprisesa Field Programmable Gate Array (FPGA), an ASIC, or various otherelectronic components for executing instructions. The read-only-memory(ROM) 9520 stores static data and instructions that are needed by theprocessor 9510 and other modules of the computer system. The permanentstorage device 9525, on the other hand, is a read-and-write memorydevice. This device is a non-volatile memory unit that storesinstruction and data even when the computer system 9500 is off. Someembodiments of the invention use a mass-storage device (such as amagnetic or optical disk and its corresponding disk drive) as thepermanent storage device 9525. Some embodiments use one or moreremovable storage devices (flash memory card or memory stick) as thepermanent storage device.

Like the permanent storage device 9525, the system memory 9515 is aread-and-write memory device. However, unlike storage device 9525, thesystem memory is a volatile read-and-write memory, such as a randomaccess memory. The system memory stores some of the instructions anddata that the processor needs at runtime.

Instructions and/or data needed to perform processes of some embodimentsare stored in the system memory 9515, the permanent storage device 9525,the read-only memory 9520, or any combination of the three. For example,the various memory units contain instructions for processing multimediaitems in accordance with some embodiments. From these various memoryunits, the processor 9510 retrieves instructions to execute and data toprocess in order to execute the processes of some embodiments.

The bus 9505 also connects to the input and output devices 9530 and9535. The input devices enable the user to communicate information andselect commands to the computer system. The input devices 9530 includealphanumeric keyboards and cursor-controllers. The output devices 9535display images generated by the computer system. The output devicesinclude printers and display devices, such as cathode ray tubes (CRT) orliquid crystal displays (LCD). Finally, as shown in FIG. 95, bus 9505also couples computer 9500 to a network 9565 through a network adapter(not shown). In this manner, the computer can be a part of a network ofcomputers (such as a local area network (“LAN”), a wide area network(“WAN”), or an Intranet) or a network of networks (such as theInternet).

It should be recognized by one of ordinary skill in the art that any orall of the components of computer system 9500 may be used in conjunctionwith the invention. For instance, some or all components of the computersystem described with regards to FIG. 95 comprise some embodiments ofthe UE, FAP, GANC, and other equipments described above. Moreover, oneof ordinary skill in the art will appreciate that any other systemconfiguration may also be used in conjunction with the invention orcomponents of the invention.

X. DEFINITIONS AND ABBREVIATIONS

The following is a list of definitions and abbreviations used:

-   -   AAA Authentication, Authorization and Accounting    -   AKA Authentication and Key Agreement    -   AP Access Point    -   AS Access Stratum    -   BSC Base Station Controller    -   BSS Base Station Subsystem    -   BSSGP Base Station System GPRS Protocol    -   BSSMAP Base Station System Management Application Part    -   CC Call Control    -   CGI Cell Global Identification    -   CM Connection Management    -   CN Core Network    -   CS Circuit Switched    -   CTM Cellular Text Telephone Modem    -   DNS Domain Name System    -   DTM Dual Transfer Mode    -   EAP Extensible Authentication Protocol    -   GA-CSR Generic Access—Circuit Switched Resources    -   GA-PSR Generic Access—Packet Switched Resources    -   GA-RC Generic Access—Resource Control    -   GAN Generic Access Network    -   GANC Generic Access Network Controller    -   ETSI European Telecommunications Standards Institute    -   FCC US Federal Communications Commission    -   FQDN Fully Qualified Domain Name    -   GAD Geographical Area Description    -   GERAN GSM EDGE Radio Access Network    -   GGSN Gateway GPRS Support Node    -   GMM/SM GPRS Mobility Management and Session Management    -   GPRS General Packet Radio Service    -   GSM Global System for Mobile communications    -   GSN GPRS Support Node    -   HLR Home Location Register    -   HPLMN Home PLMN    -   IETF Internet Engineering Task Force    -   IKE Internet Key Exchange    -   IKEv2 IKE Version 2    -   IMEISV International Mobile station Equipment Identity and        Software Version number    -   IMSI International Mobile Subscriber Identity    -   IP Internet Protocol    -   LA Location Area    -   LAI Location Area Identity    -   LLC Logical Link Control    -   MAC Medium Access Control    -   MAC Message Authentication Code    -   MM Mobility Management    -   MS Mobile Station    -   MSC Mobile Switching Center    -   MTP1 Message Transfer Part layer 1    -   MTP2 Message Transfer Part layer 2    -   MTP3 Message Transfer Part layer 3    -   NAS Non-Access Stratum    -   PDP Packet Data Protocol    -   PDU Protocol Data Unit    -   PLMN Public Land Mobile Network    -   PSAP Public Safety Answering Point—A PSAP is an emergency        services network element that is responsible for answering        emergency calls    -   PSTN Public Switched Telephone Network    -   P-TMSI Packet—TMSI    -   QoS Quality of Service    -   RA Routing Area    -   RAC Routing Area Code    -   RAI Routing Area Identity    -   RAT Radio Access Technology    -   RLC Radio Link Control    -   RNC Radio Network Controller    -   RNS Radio Network Subsystem    -   RTCP Real Time Control Protocol    -   RTP Real Time Protocol    -   SCCP Signaling Connection Control Part    -   SEGW SEcurity GateWay    -   SGSN Serving GPRS Support Node    -   SIM Subscriber Identity Module    -   SMLC Serving Mobile Location Center    -   SMS Short Message Service    -   SNDCP Sub-Network Dependent Convergence Protocol    -   TBF Temporary Block Flow    -   TC Transport Channel    -   TCP Transmission Control Protocol    -   TFO Tandem Free Operation    -   TMSI Temporary Mobile Subscriber Identity    -   TrFO Transcoder Free Operation    -   TTY Text Telephone or TeletYpewriter    -   UE User Equipment    -   UDP User Datagram Protocol    -   UMTS Universal Mobile Telecommunication System    -   UTRAN UMTS terrestrial Radio Access Network    -   Up Up is the Interface between UE and GANC    -   VLR Visited Location Register    -   VPLMN Visited Public Land Mobile Network

While the invention has been described with reference to numerousspecific details, one of ordinary skill in the art will recognize thatthe invention can be embodied in other specific forms without departingfrom the spirit of the invention. For instance the specific sequencingof procedures described and their associated attributes may be modified.Thus, one of ordinary skill in the art would understand that theinvention is not to be limited by the foregoing illustrative details,but rather is to be defined by the appended claims.

1-4. (canceled)
 5. A method of relocating a packet service (PS)communication session of a user equipment (UE) from a first wirelesscommunication system comprising a network controller to a secondwireless communication system comprising a core network and a universalmobile telecommunication system (UMTS) terrestrial radio access network(UTRAN), wherein the UTRAN and the network controller are forcommunicatively coupling the UE to the core network, the methodcomprising: a) receiving a handover command at the UE, the handovercommand comprising a channel access information for a target cell in theUTRAN; b) accessing the target UTRAN cell by the UE using said channelaccess information; c) configuring a set of UE protocol layers forreceiving data from the UTRAN; and d) receiving packet data at the UEfrom the UTRAN.